Re: [Stable-review] [087/165] Fix for buffer overflow in ldm_frag_add not sufficient

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1892 bytes --]

On Wed, 2011-06-01 at 17:10 +0900, Greg KH wrote:
> 2.6.39-stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> Content-Length: 1139
> Lines: 36
> 
> From: Timo Warns <Warns@pre-sense.de>
> 
> commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
> 
> As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
> overflow in ldm_frag_add) is not sufficient.  The original patch in
> commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
> partition table") does not consider that, for subsequent fragments,
> previously allocated memory is used.
> 
> [1] http://lkml.org/lkml/2011/5/6/407

I still assert that the function is broken because the fragments are
copied to incorrect offsets.  However, this change should at least make
it *harmless* junk.

Ben.

> Reported-by: Ben Hutchings <ben@decadent.org.uk>
> Signed-off-by: Timo Warns <warns@pre-sense.de>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> ---
>  fs/partitions/ldm.c |    5 +++++
>  1 file changed, 5 insertions(+)
> 
> --- a/fs/partitions/ldm.c
> +++ b/fs/partitions/ldm.c
> @@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
>  
>  	list_add_tail (&f->list, frags);
>  found:
> +	if (rec >= f->num) {
> +		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
> +		return false;
> +	}
> +
>  	if (f->map & (1 << rec)) {
>  		ldm_error ("Duplicate VBLK, part %d.", rec);
>  		f->map &= 0x7F;			/* Mark the group as broken */
> 
> 
> _______________________________________________
> Stable-review mailing list
> Stable-review@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/stable-review
> 

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]