From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 932841E89C; Thu, 25 Jul 2024 14:46:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721918797; cv=none; b=pYZYeF72bCwjLRpQJhQ93fjhdbL3v5OUeauHebvzQmKyuU1wYlN4JluJBFEhi2qh0HBFE59nwfssw7smPElfNRvclkBCYu8aCceri7vkH1eUUSZ172lzWpmpKkZ9RNMpkU4C9/xM+w6yR4Skx0Bgla+3rX5gb0jUfvJrndDD9Po= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721918797; c=relaxed/simple; bh=oRiar7uXRQ3kS4a5+jjuqhiLXKqoVg31AVVdkrl5F0M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BEd0w9oBasFdmgB5dSfDp4yV6IYjU6QEKihD3aGLrhywLHGv9Z62bmHtcGzTwgG2pYtHVJRIblgDjf6+8878gd3WtCXcA41MBQNl61cEOnjxmu6XZGtkePL8VjBlKeqUiVzqmMxm7dvphsRFXJ0dusLPZmdqZXS0KQ6CMDx4ie4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EwkDlbx+; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EwkDlbx+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3B69C116B1; Thu, 25 Jul 2024 14:46:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1721918797; bh=oRiar7uXRQ3kS4a5+jjuqhiLXKqoVg31AVVdkrl5F0M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EwkDlbx+VqS7WgTZkDN5WW2BsSdyqZxgvDXguqJGQOJBHEX0rz0oI3+A+q5UZQUKk Q1/D9QISIr1U+aGkv1hFauklN5H1KvNMEOLie+3sVCG38EzfwlY4+NYzuleqDInzWP xQobjHcRkhVZ3+f12qpP/DMBOOPi74JSHfbt6pIc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, lei lu , Dave Kleikamp Subject: [PATCH 6.9 04/29] jfs: dont walk off the end of ealist Date: Thu, 25 Jul 2024 16:37:14 +0200 Message-ID: <20240725142731.848085993@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240725142731.678993846@linuxfoundation.org> References: <20240725142731.678993846@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: lei lu commit d0fa70aca54c8643248e89061da23752506ec0d4 upstream. Add a check before visiting the members of ea to make sure each ea stays within the ealist. Signed-off-by: lei lu Signed-off-by: Dave Kleikamp Signed-off-by: Greg Kroah-Hartman --- fs/jfs/xattr.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *ino size_t buf_size) { struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; int xattr_size; ssize_t size; @@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *ino goto not_found; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* Find the named attribute */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if ((namelen == ea->namelen) && memcmp(name, ea->name, namelen) == 0) { /* Found it */ @@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *ino memcpy(data, value, size); goto release; } + } not_found: size = -ENODATA; release: @@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * de ssize_t size = 0; int xattr_size; struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; down_read(&JFS_IP(inode)->xattr_sem); @@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * de goto release; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* compute required size of list */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if (can_list(ea)) size += name_size(ea) + 1; }