From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:53924 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751340AbdFEPJt (ORCPT ); Mon, 5 Jun 2017 11:09:49 -0400 Subject: Patch "xfs: fix over-copying of getbmap parameters from userspace" has been added to the 4.9-stable tree To: darrick.wong@oracle.com, gregkh@linuxfoundation.org, hch@lst.de Cc: , From: Date: Mon, 05 Jun 2017 17:08:47 +0200 Message-ID: <1496675327230200@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled xfs: fix over-copying of getbmap parameters from userspace to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-fix-over-copying-of-getbmap-parameters-from-userspace.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From be6324c00c4d1e0e665f03ed1fc18863a88da119 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Mon, 3 Apr 2017 15:17:57 -0700 Subject: xfs: fix over-copying of getbmap parameters from userspace From: Darrick J. Wong commit be6324c00c4d1e0e665f03ed1fc18863a88da119 upstream. In xfs_ioc_getbmap, we should only copy the fields of struct getbmap from userspace, or else we end up copying random stack contents into the kernel. struct getbmap is a strict subset of getbmapx, so a partial structure copy should work fine. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -1542,10 +1542,11 @@ xfs_ioc_getbmap( unsigned int cmd, void __user *arg) { - struct getbmapx bmx; + struct getbmapx bmx = { 0 }; int error; - if (copy_from_user(&bmx, arg, sizeof(struct getbmapx))) + /* struct getbmap is a strict subset of struct getbmapx. */ + if (copy_from_user(&bmx, arg, offsetof(struct getbmapx, bmv_iflags))) return -EFAULT; if (bmx.bmv_count < 2) Patches currently in stable-queue which might be from darrick.wong@oracle.com are queue-4.9/xfs-fix-missed-holes-in-seek_hole-implementation.patch queue-4.9/xfs-fix-indlen-accounting-error-on-partial-delalloc-conversion.patch queue-4.9/xfs-fix-over-copying-of-getbmap-parameters-from-userspace.patch queue-4.9/xfs-bad-assertion-for-delalloc-an-extent-that-start-at-i_size.patch queue-4.9/xfs-bmapx-shouldn-t-barf-on-inline-format-directories.patch queue-4.9/xfs-drop-iolock-from-reclaim-context-to-appease-lockdep.patch queue-4.9/xfs-fix-off-by-one-on-max-nr_pages-in-xfs_find_get_desired_pgoff.patch queue-4.9/xfs-update-ag-iterator-to-support-wait-on-new-inodes.patch queue-4.9/xfs-use-dedicated-log-worker-wq-to-avoid-deadlock-with-cil-wq.patch queue-4.9/xfs-fix-up-quotacheck-buffer-list-error-handling.patch queue-4.9/xfs-wait-on-new-inodes-during-quotaoff-dquot-release.patch queue-4.9/xfs-rework-the-inline-directory-verifiers.patch queue-4.9/xfs-use-b_state-to-fix-buffer-i-o-accounting-release-race.patch queue-4.9/xfs-avoid-mount-time-deadlock-in-cow-extent-recovery.patch queue-4.9/xfs-fix-off-by-in-in-loop-termination-in-xfs_find_get_desired_pgoff.patch queue-4.9/xfs-xfs_trans_alloc_empty.patch queue-4.9/xfs-fix-integer-truncation-in-xfs_bmap_remap_alloc.patch queue-4.9/xfs-actually-report-xattr-extents-via-iomap.patch queue-4.9/xfs-fix-use-after-free-in-xfs_finish_page_writeback.patch queue-4.9/xfs-reserve-enough-blocks-to-handle-btree-splits-when-remapping.patch queue-4.9/xfs-support-ability-to-wait-on-new-inodes.patch queue-4.9/xfs-verify-inline-directory-data-forks.patch queue-4.9/xfs-prevent-multi-fsb-dir-readahead-from-reading-random-blocks.patch queue-4.9/xfs-fix-unaligned-access-in-xfs_btree_visit_blocks.patch queue-4.9/xfs-handle-array-index-overrun-in-xfs_dir2_leaf_readbuf.patch queue-4.9/xfs-fix-kernel-memory-exposure-problems.patch