* [patch] xfs: underflow bug in xfs_attrlist_by_handle()
[not found] <20131025144452.GA28451@ngolde.de>
@ 2013-10-31 18:00 ` Dan Carpenter
2013-10-31 21:34 ` Dave Chinner
2013-12-04 21:53 ` Ben Myers
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2013-10-31 18:00 UTC (permalink / raw)
To: Ben Myers; +Cc: Fabian Yamaguchi, security, Alex Elder, Nico Golde, xfs
If we allocate less than sizeof(struct attrlist) then we end up
corrupting memory or doing a ZERO_PTR_SIZE dereference.
This can only be triggered with CAP_SYS_ADMIN.
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 4d61340..33ad9a7 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -442,7 +442,8 @@ xfs_attrlist_by_handle(
return -XFS_ERROR(EPERM);
if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
return -XFS_ERROR(EFAULT);
- if (al_hreq.buflen > XATTR_LIST_MAX)
+ if (al_hreq.buflen < sizeof(struct attrlist) ||
+ al_hreq.buflen > XATTR_LIST_MAX)
return -XFS_ERROR(EINVAL);
/*
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index e8fb123..a7992f8 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -356,7 +356,8 @@ xfs_compat_attrlist_by_handle(
if (copy_from_user(&al_hreq, arg,
sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
return -XFS_ERROR(EFAULT);
- if (al_hreq.buflen > XATTR_LIST_MAX)
+ if (al_hreq.buflen < sizeof(struct attrlist) ||
+ al_hreq.buflen > XATTR_LIST_MAX)
return -XFS_ERROR(EINVAL);
/*
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] xfs: underflow bug in xfs_attrlist_by_handle()
2013-10-31 18:00 ` [patch] xfs: underflow bug in xfs_attrlist_by_handle() Dan Carpenter
@ 2013-10-31 21:34 ` Dave Chinner
2013-12-04 21:53 ` Ben Myers
1 sibling, 0 replies; 3+ messages in thread
From: Dave Chinner @ 2013-10-31 21:34 UTC (permalink / raw)
To: Dan Carpenter
Cc: Fabian Yamaguchi, security, Alex Elder, xfs, Ben Myers,
Nico Golde
On Thu, Oct 31, 2013 at 09:00:10PM +0300, Dan Carpenter wrote:
> If we allocate less than sizeof(struct attrlist) then we end up
> corrupting memory or doing a ZERO_PTR_SIZE dereference.
>
> This can only be triggered with CAP_SYS_ADMIN.
>
> Reported-by: Nico Golde <nico@ngolde.de>
> Reported-by: Fabian Yamaguchi <fabs@goesec.de>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> index 4d61340..33ad9a7 100644
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -442,7 +442,8 @@ xfs_attrlist_by_handle(
> return -XFS_ERROR(EPERM);
> if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
> return -XFS_ERROR(EFAULT);
> - if (al_hreq.buflen > XATTR_LIST_MAX)
> + if (al_hreq.buflen < sizeof(struct attrlist) ||
> + al_hreq.buflen > XATTR_LIST_MAX)
> return -XFS_ERROR(EINVAL);
Yup, that's not checked in xfs_attr_list(). Looks like these are the
only direct callers of xfs_attr_list(), and the other callers of
xfs_attr_list_int() don't appear to have the same issue. Good find!
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Cheers,
Dave.
--
Dave Chinner
david@fromorbit.com
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch] xfs: underflow bug in xfs_attrlist_by_handle()
2013-10-31 18:00 ` [patch] xfs: underflow bug in xfs_attrlist_by_handle() Dan Carpenter
2013-10-31 21:34 ` Dave Chinner
@ 2013-12-04 21:53 ` Ben Myers
1 sibling, 0 replies; 3+ messages in thread
From: Ben Myers @ 2013-12-04 21:53 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Fabian Yamaguchi, security, Alex Elder, Nico Golde, xfs
On Thu, Oct 31, 2013 at 09:00:10PM +0300, Dan Carpenter wrote:
> If we allocate less than sizeof(struct attrlist) then we end up
> corrupting memory or doing a ZERO_PTR_SIZE dereference.
>
> This can only be triggered with CAP_SYS_ADMIN.
>
> Reported-by: Nico Golde <nico@ngolde.de>
> Reported-by: Fabian Yamaguchi <fabs@goesec.de>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied. Thanks Dan.
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-12-04 21:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20131025144452.GA28451@ngolde.de>
2013-10-31 18:00 ` [patch] xfs: underflow bug in xfs_attrlist_by_handle() Dan Carpenter
2013-10-31 21:34 ` Dave Chinner
2013-12-04 21:53 ` Ben Myers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox