linux-ext4 - Re: problem in ext2fs_get_next_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Feb 2016 15:30:35 -0700
From:	Andreas Dilger <adilger@...ger.ca>
To:	Theodore Ts'o <tytso@....edu>
Cc:	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Re: problem in ext2fs_get_next_inode_full() ?

On Feb 18, 2016, at 3:05 PM, Dilger, Andreas <andreas.dilger@...el.com> wrote:
> 
> I was just looking at ext2fs_get_next_inode_full() to trace where we
> are using large inodes and whether we could change the APIs to just
> pass large inodes around instead of typecasting them.  It has the
> following hunk of code:
> 
>        if (extra_bytes) {
> 		memcpy(scan->temp_buffer+extra_bytes, scan->ptr,
> 		       scan->inode_size - extra_bytes);
> 		scan->ptr += scan->inode_size - extra_bytes;
> 		scan->bytes_left -= scan->inode_size - extra_bytes;
> 
> #ifdef WORDS_BIGENDIAN
> 		memset(inode, 0, bufsize);
> 		ext2fs_swap_inode_full(scan->fs,
> 				(struct ext2_inode_large *) inode,
> 				(struct ext2_inode_large *) scan->temp_buffer,
> 				0, bufsize);
> #else
> 		*inode = *((struct ext2_inode *) scan->temp_buffer);
> #endif
> 
> So if the inode is being swabbed then it handles the full inode size, but
> if it is not being swabbed (the common case) it appears that it is only
> copying the small inode into "*inode" using a struct assignment.  This
> appears like it would be dropping the large inode data, but I'm not sure
> if or when this "extra_bytes" case is hit.  The "else" clause appears to
> copy the requested (full) inode size properly via "memcpy(..., bufsize)".
> 
> Should the struct assignment be changed similarly to use memcpy()?

To follow up on my own email - I also see struct ext2_inode_cache_ent is
only caching the small inode, and not a large inode.  This would seem to
potentially cause loss of the large inode data if the inode cache is
used by tools like resize2fs or others that move around inodes?

Cheers, Andreas





--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html