From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk, Sasha Levin <levinsasha928@gmail.com>,
Hugh Dickins <hughd@google.com>,
Al Viro <viro@zeniv.linux.org.uk>, Sage Weil <sage@inktank.com>,
Steven Whitehouse <swhiteho@redhat.com>,
Christoph Hellwig <hch@infradead.org>
Subject: [ 06/37] tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
Date: Thu, 18 Oct 2012 20:16:29 -0700 [thread overview]
Message-ID: <20121019031303.860355071@linuxfoundation.org> (raw)
In-Reply-To: <20121019031302.789593147@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit 35c2a7f4908d404c9124c2efc6ada4640ca4d5d5 upstream.
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():
BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
[<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
[<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
[<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
[<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.
But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/export.c | 18 ++++++++++++++----
fs/gfs2/export.c | 4 ++++
fs/isofs/export.c | 2 +-
fs/reiserfs/inode.c | 6 +++++-
fs/xfs/linux-2.6/xfs_export.c | 3 +++
mm/shmem.c | 6 ++++--
6 files changed, 31 insertions(+), 8 deletions(-)
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -84,7 +84,7 @@ static int ceph_encode_fh(struct dentry
* FIXME: we should try harder by querying the mds for the ino.
*/
static struct dentry *__fh_to_dentry(struct super_block *sb,
- struct ceph_nfs_fh *fh)
+ struct ceph_nfs_fh *fh, int fh_len)
{
struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
struct inode *inode;
@@ -92,6 +92,9 @@ static struct dentry *__fh_to_dentry(str
struct ceph_vino vino;
int err;
+ if (fh_len < sizeof(*fh) / 4)
+ return ERR_PTR(-ESTALE);
+
dout("__fh_to_dentry %llx\n", fh->ino);
vino.ino = fh->ino;
vino.snap = CEPH_NOSNAP;
@@ -136,7 +139,7 @@ static struct dentry *__fh_to_dentry(str
* convert connectable fh to dentry
*/
static struct dentry *__cfh_to_dentry(struct super_block *sb,
- struct ceph_nfs_confh *cfh)
+ struct ceph_nfs_confh *cfh, int fh_len)
{
struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
struct inode *inode;
@@ -144,6 +147,9 @@ static struct dentry *__cfh_to_dentry(st
struct ceph_vino vino;
int err;
+ if (fh_len < sizeof(*cfh) / 4)
+ return ERR_PTR(-ESTALE);
+
dout("__cfh_to_dentry %llx (%llx/%x)\n",
cfh->ino, cfh->parent_ino, cfh->parent_name_hash);
@@ -193,9 +199,11 @@ static struct dentry *ceph_fh_to_dentry(
int fh_len, int fh_type)
{
if (fh_type == 1)
- return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw);
+ return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw,
+ fh_len);
else
- return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw);
+ return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw,
+ fh_len);
}
/*
@@ -216,6 +224,8 @@ static struct dentry *ceph_fh_to_parent(
if (fh_type == 1)
return ERR_PTR(-ESTALE);
+ if (fh_len < sizeof(*cfh) / 4)
+ return ERR_PTR(-ESTALE);
pr_debug("fh_to_parent %llx/%d\n", cfh->parent_ino,
cfh->parent_name_hash);
--- a/fs/gfs2/export.c
+++ b/fs/gfs2/export.c
@@ -167,6 +167,8 @@ static struct dentry *gfs2_fh_to_dentry(
case GFS2_SMALL_FH_SIZE:
case GFS2_LARGE_FH_SIZE:
case GFS2_OLD_FH_SIZE:
+ if (fh_len < GFS2_SMALL_FH_SIZE)
+ return NULL;
this.no_formal_ino = ((u64)be32_to_cpu(fh[0])) << 32;
this.no_formal_ino |= be32_to_cpu(fh[1]);
this.no_addr = ((u64)be32_to_cpu(fh[2])) << 32;
@@ -186,6 +188,8 @@ static struct dentry *gfs2_fh_to_parent(
switch (fh_type) {
case GFS2_LARGE_FH_SIZE:
case GFS2_OLD_FH_SIZE:
+ if (fh_len < GFS2_LARGE_FH_SIZE)
+ return NULL;
parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32;
parent.no_formal_ino |= be32_to_cpu(fh[5]);
parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32;
--- a/fs/isofs/export.c
+++ b/fs/isofs/export.c
@@ -179,7 +179,7 @@ static struct dentry *isofs_fh_to_parent
{
struct isofs_fid *ifid = (struct isofs_fid *)fid;
- if (fh_type != 2)
+ if (fh_len < 2 || fh_type != 2)
return NULL;
return isofs_export_iget(sb,
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1568,8 +1568,10 @@ struct dentry *reiserfs_fh_to_dentry(str
reiserfs_warning(sb, "reiserfs-13077",
"nfsd/reiserfs, fhtype=%d, len=%d - odd",
fh_type, fh_len);
- fh_type = 5;
+ fh_type = fh_len;
}
+ if (fh_len < 2)
+ return NULL;
return reiserfs_get_dentry(sb, fid->raw[0], fid->raw[1],
(fh_type == 3 || fh_type >= 5) ? fid->raw[2] : 0);
@@ -1578,6 +1580,8 @@ struct dentry *reiserfs_fh_to_dentry(str
struct dentry *reiserfs_fh_to_parent(struct super_block *sb, struct fid *fid,
int fh_len, int fh_type)
{
+ if (fh_type > fh_len)
+ fh_type = fh_len;
if (fh_type < 4)
return NULL;
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -195,6 +195,9 @@ xfs_fs_fh_to_parent(struct super_block *
struct xfs_fid64 *fid64 = (struct xfs_fid64 *)fid;
struct inode *inode = NULL;
+ if (fh_len < xfs_fileid_length(fileid_type))
+ return NULL;
+
switch (fileid_type) {
case FILEID_INO32_GEN_PARENT:
inode = xfs_nfs_get_inode(sb, fid->i32.parent_ino,
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2348,12 +2348,14 @@ static struct dentry *shmem_fh_to_dentry
{
struct inode *inode;
struct dentry *dentry = NULL;
- u64 inum = fid->raw[2];
- inum = (inum << 32) | fid->raw[1];
+ u64 inum;
if (fh_len < 3)
return NULL;
+ inum = fid->raw[2];
+ inum = (inum << 32) | fid->raw[1];
+
inode = ilookup5(sb, (unsigned long)(inum + fid->raw[0]),
shmem_match, fid->raw);
if (inode) {
next prev parent reply other threads:[~2012-10-19 3:27 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-19 3:16 [ 00/37] 3.0.47-stable review Greg Kroah-Hartman
2012-10-19 3:16 ` [ 01/37] ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels Greg Kroah-Hartman
2012-10-19 3:16 ` [ 02/37] lockd: use rpc clients cl_nodename for id encoding Greg Kroah-Hartman
2012-10-19 23:15 ` Ben Hutchings
2012-10-21 16:26 ` Greg Kroah-Hartman
2012-10-22 17:02 ` Myklebust, Trond
2012-10-23 1:36 ` Ben Hutchings
2012-10-24 15:44 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 03/37] ACPI: EC: Make the GPE storm threshold a module parameter Greg Kroah-Hartman
2012-10-19 3:16 ` [ 04/37] ACPI: EC: Add a quirk for CLEVO M720T/M730T laptop Greg Kroah-Hartman
2012-10-19 3:16 ` [ 05/37] mips,kgdb: fix recursive page fault with CONFIG_KPROBES Greg Kroah-Hartman
2012-10-19 3:16 ` Greg Kroah-Hartman [this message]
2012-10-19 3:16 ` [ 07/37] ARM: 7541/1: Add ARM ERRATA 775420 workaround Greg Kroah-Hartman
2012-10-19 3:16 ` [ 08/37] firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel) Greg Kroah-Hartman
2012-10-19 3:16 ` [ 09/37] SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT Greg Kroah-Hartman
2012-10-19 3:16 ` [ 10/37] xen/bootup: allow {read|write}_cr8 pvops call Greg Kroah-Hartman
2012-10-19 3:16 ` [ 11/37] xen/bootup: allow read_tscp call for Xen PV guests Greg Kroah-Hartman
2012-10-19 3:16 ` [ 12/37] block: fix request_queue->flags initialization Greg Kroah-Hartman
2012-10-19 23:16 ` Ben Hutchings
2012-10-21 16:25 ` Greg Kroah-Hartman
2012-10-21 18:56 ` Tejun Heo
2012-10-22 15:36 ` Greg Kroah-Hartman
2012-10-19 3:16 ` [ 13/37] autofs4 - fix reset pending flag on mount fail Greg Kroah-Hartman
2012-10-19 3:16 ` [ 14/37] module: taint kernel when lve module is loaded Greg Kroah-Hartman
2012-10-19 3:16 ` [ 15/37] video/udlfb: fix line counting in fb_write Greg Kroah-Hartman
2012-10-19 3:16 ` [ 16/37] viafb: dont touch clock state on OLPC XO-1.5 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 17/37] timers: Fix endless looping between cascade() and internal_add_timer() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 18/37] pktgen: fix crash when generating IPv6 packets Greg Kroah-Hartman
2012-10-19 3:16 ` [ 19/37] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
2012-10-19 3:16 ` [ 20/37] ipvs: fix oops in ip_vs_dst_event on rmmod Greg Kroah-Hartman
2012-10-19 3:16 ` [ 21/37] netfilter: nf_conntrack: fix racy timer handling with reliable events Greg Kroah-Hartman
2012-10-19 3:16 ` [ 22/37] netfilter: nf_ct_ipv4: packets with wrong ihl are invalid Greg Kroah-Hartman
2012-10-19 3:16 ` [ 23/37] netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation Greg Kroah-Hartman
2012-10-19 3:16 ` [ 24/37] ipvs: fix oops on NAT reply in br_nf context Greg Kroah-Hartman
2012-10-19 3:16 ` [ 25/37] netfilter: nf_nat_sip: fix via header translation with multiple parameters Greg Kroah-Hartman
2012-10-19 3:16 ` [ 26/37] netfilter: nf_ct_expect: fix possible access to uninitialized timer Greg Kroah-Hartman
2012-10-19 3:16 ` [ 27/37] netfilter: limit, hashlimit: avoid duplicated inline Greg Kroah-Hartman
2012-10-19 3:16 ` [ 28/37] netfilter: xt_limit: have r->cost != 0 case work Greg Kroah-Hartman
2012-10-19 3:16 ` [ 29/37] Add CDC-ACM support for the CX93010-2x UCMxx USB Modem Greg Kroah-Hartman
2012-10-19 3:16 ` [ 30/37] drm/radeon: Dont destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy() Greg Kroah-Hartman
2012-10-19 3:16 ` [ 31/37] jbd: Fix assertion failure in commit code due to lacking transaction credits Greg Kroah-Hartman
2012-10-19 3:16 ` [ 32/37] x86, random: Architectural inlines to get random integers with RDRAND Greg Kroah-Hartman
2012-10-19 3:16 ` [ 33/37] x86, random: Verify RDRAND functionality and allow it to be disabled Greg Kroah-Hartman
2012-10-19 3:16 ` [ 34/37] tpm: Propagate error from tpm_transmit to fix a timeout hang Greg Kroah-Hartman
2012-10-19 3:16 ` [ 35/37] udf: fix retun value on error path in udf_load_logicalvol Greg Kroah-Hartman
2012-10-19 3:16 ` [ 36/37] ALSA: ac97 - Fix missing NULL check in snd_ac97_cvol_new() Greg Kroah-Hartman
2012-10-19 3:17 ` [ 37/37] ALSA: emu10k1: add chip details for E-mu 1010 PCIe card Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121019031303.860355071@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=hch@infradead.org \
--cc=hughd@google.com \
--cc=levinsasha928@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sage@inktank.com \
--cc=stable@vger.kernel.org \
--cc=swhiteho@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).