linux-kernel - Re: [PATCH] JFS: ensure link targets are NULL-terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 11 Dec 2008 14:06:11 -0600
From:	Dave Kleikamp <shaggy@...ux.vnet.ibm.com>
To:	Duane Griffin <duaneg@...da.com>
Cc:	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	Boaz Harrosh <bharrosh@...asas.com>,
	Dave.Kleikamp.shaggy@...tin.ibm.com,
	jfs-discussion@...ts.sourceforge.net
Subject: Re: [PATCH] JFS: ensure link targets are NULL-terminated

On Thu, 2008-12-11 at 19:16 +0000, Duane Griffin wrote:
> Ensure link targets are NULL-terminated, even if corrupted on-disk.
> 
> Signed-off-by: Duane Griffin <duaneg@...da.com>
> ---
>  fs/jfs/symlink.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/fs/jfs/symlink.c b/fs/jfs/symlink.c
> index 4af1a05..f5f1b5d 100644
> --- a/fs/jfs/symlink.c
> +++ b/fs/jfs/symlink.c
> @@ -18,6 +18,7 @@
>  
>  #include <linux/fs.h>
>  #include <linux/namei.h>
> +#include "jfs_filsys.h"
>  #include "jfs_incore.h"
>  #include "jfs_inode.h"
>  #include "jfs_xattr.h"
> @@ -25,6 +26,7 @@
>  static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
>  {
>  	char *s = JFS_IP(dentry->d_inode)->i_inline;
> +	s[IDATASIZE - 1] = '\0';
>  	nd_set_link(nd, s);
>  	return NULL;
>  }

Thanks.

I came up with an alternate patch that I like slightly better.  This one
null-terminates the string when the inode is read rather than every time
the link is followed, and at the proper place (i_size).  It's not a big
deal, since the symlink will be corrupted either way.  What do you think
of this patch?

Signed-off-by: Dave Kleikamp <shaggy@...ux.vnet.ibm.com>

diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 2103397..b00ee9f 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -59,8 +59,14 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
 		if (inode->i_size >= IDATASIZE) {
 			inode->i_op = &page_symlink_inode_operations;
 			inode->i_mapping->a_ops = &jfs_aops;
-		} else
+		} else {
 			inode->i_op = &jfs_symlink_inode_operations;
+			/*
+			 * The inline data should be null-terminated, but
+			 * don't let on-disk corruption crash the kernel
+			 */
+			JFS_IP(inode)->i_inline[inode->i_size] = '\0';
+		}
 	} else {
 		inode->i_op = &jfs_file_inode_operations;
 		init_special_inode(inode, inode->i_mode, inode->i_rdev);

-- 
David Kleikamp
IBM Linux Technology Center

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/