From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ipmail05.adl6.internode.on.net ([150.101.137.143]:36266 "EHLO ipmail05.adl6.internode.on.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966184AbbD2Hn1 (ORCPT ); Wed, 29 Apr 2015 03:43:27 -0400 Date: Wed, 29 Apr 2015 17:43:16 +1000 From: Dave Chinner To: Sheng Yong Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org Subject: Re: [PATCH] xfs: remote attribute overwrite causes transaction overrun Message-ID: <20150429074316.GV15810@dastard> References: <1430272525-60351-1-git-send-email-shengyong1@huawei.com> <1430272525-60351-2-git-send-email-shengyong1@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1430272525-60351-2-git-send-email-shengyong1@huawei.com> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Apr 29, 2015 at 01:55:25AM +0000, Sheng Yong wrote: > commit 8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59 upstream. > > Commit e461fcb ("xfs: remote attribute lookups require the value > length") passes the remote attribute length in the xfs_da_args > structure on lookup so that CRC calculations and validity checking > can be performed correctly by related code. This, unfortunately has > the side effect of changing the args->valuelen parameter in cases > where it shouldn't. > > That is, when we replace a remote attribute, the incoming > replacement stores the value and length in args->value and > args->valuelen, but then the lookup which finds the existing remote > attribute overwrites args->valuelen with the length of the remote > attribute being replaced. Hence when we go to create the new > attribute, we create it of the size of the existing remote > attribute, not the size it is supposed to be. When the new attribute > is much smaller than the old attribute, this results in a > transaction overrun and an ASSERT() failure on a debug kernel: > > XFS: Assertion failed: tp->t_blk_res_used <= tp->t_blk_res, file: fs/xfs/xfs_trans.c, line: 331 > > Fix this by keeping the remote attribute value length separate to > the attribute value length in the xfs_da_args structure. The enables > us to pass the length of the remote attribute to be removed without > overwriting the new attribute's length. > > Also, ensure that when we save remote block contexts for a later > rename we zero the original state variables so that we don't confuse > the state of the attribute to be removes with the state of the new > attribute that we just added. [Spotted by Brain Foster.] > > Signed-off-by: Dave Chinner > Reviewed-by: Brian Foster > Signed-off-by: Dave Chinner > [shengyong: backport to 3.10 > - Addresse: CVE-2015-0274 > - adjust context > - fs/xfs/xfs_attr_list.c comes from fs/xfs/xfs_attr.c and > fs/xfs/xfs_attr_leaf.c in linux 3.12] > Signed-off-by: Sheng Yong You are backporting to 3.10? Check when Commit e461fcb ("xfs: remote attribute lookups require the value length") was introduced: $ git describe --contains e461fcb for-linus-v3.11-rc1~53 $ Seems to me like the problem the CVE describes didn't exist in 3.10... Cheers, Dave. -- Dave Chinner david@fromorbit.com