From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Stian Skjelstad <stian.skjelstad@gmail.com>,
Jan Kara <jack@suse.cz>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.4 28/30] udf_get_extendedattr() had no boundary checks.
Date: Sun, 5 Sep 2021 21:22:41 -0400 [thread overview]
Message-ID: <20210906012244.930338-28-sashal@kernel.org> (raw)
In-Reply-To: <20210906012244.930338-1-sashal@kernel.org>
From: Stian Skjelstad <stian.skjelstad@gmail.com>
[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.
Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/misc.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 401e64cde1be..853bcff51043 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
else
offset = le32_to_cpu(eahd->appAttrLocation);
- while (offset < iinfo->i_lenEAttr) {
+ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
+ uint32_t attrLength;
+
gaf = (struct genericFormat *)&ea[offset];
+ attrLength = le32_to_cpu(gaf->attrLength);
+
+ /* Detect undersized elements and buffer overflows */
+ if ((attrLength < sizeof(*gaf)) ||
+ (attrLength > (iinfo->i_lenEAttr - offset)))
+ break;
+
if (le32_to_cpu(gaf->attrType) == type &&
gaf->attrSubtype == subtype)
return gaf;
else
- offset += le32_to_cpu(gaf->attrLength);
+ offset += attrLength;
}
}
--
2.30.2
next prev parent reply other threads:[~2021-09-06 1:31 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 1:22 [PATCH AUTOSEL 5.4 01/30] locking/mutex: Fix HANDOFF condition Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 02/30] regmap: fix the offset of register error log Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 03/30] crypto: mxs-dcp - Check for DMA mapping errors Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 04/30] sched/deadline: Fix reset_on_fork reporting of DL tasks Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 05/30] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 06/30] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 07/30] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 08/30] rcu/tree: Handle VM stoppage in stall detection Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 09/30] posix-cpu-timers: Force next expiration recalc after itimer reset Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 10/30] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 11/30] hrtimer: Ensure timerfd notification for HIGHRES=n Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 12/30] udf: Check LVID earlier Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 13/30] udf: Fix iocharset=utf8 mount option Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 14/30] isofs: joliet: " Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 15/30] bcache: add proper error unwinding in bcache_device_init Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 16/30] nvme-tcp: don't update queue count when failing to set io queues Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 17/30] nvme-rdma: " Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 18/30] nvmet: pass back cntlid on successful completion Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 19/30] power: supply: max17042_battery: fix typo in MAx17042_TOFF Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 20/30] s390/cio: add dev_busid sysfs entry for each subchannel Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 21/30] libata: fix ata_host_start() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 22/30] crypto: qat - do not ignore errors from enable_vf2pf_comms() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 23/30] crypto: qat - handle both source of interrupt in VF ISR Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 24/30] crypto: qat - fix reuse of completion variable Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 25/30] crypto: qat - fix naming for init/shutdown VF to PF notifications Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 26/30] crypto: qat - do not export adf_iov_putmsg() Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 27/30] fcntl: fix potential deadlock for &fasync_struct.fa_lock Sasha Levin
2021-09-06 1:22 ` Sasha Levin [this message]
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 29/30] s390/kasan: fix large PMD pages address alignment check Sasha Levin
2021-09-06 1:22 ` [PATCH AUTOSEL 5.4 30/30] s390/debug: fix debug area life cycle Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906012244.930338-28-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stian.skjelstad@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox