linux-kernel - V3 minixfs bug (attempt #2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 02 Jul 2009 17:51:00 -0400
From:	"Doug Graham" <dgraham@...tel.com>
To:	linux-kernel@...r.kernel.org
Subject: V3 minixfs bug (attempt #2)

There are a few places in the Minix FS code
where the "inode" field of a minix_dir_entry is used without checking
first to see if the dirent is really a minix3_dir_entry.  The inode number
in a V1/V2 dirent is 16 bits, whereas that in a V3 dirent is 32 bits.  
Accessing
it as a 16 bit field when it really should be accessed as a 32 bit field
probably kinda sorta works on a little-endian machine, but leads to some
rather odd behaviour on big-endian machines.

Signed-off-by:  Doug Graham <dgraham@...tel.com>
---

--- linux-2.6.29.2/fs/minix/dir.c       2009/07/02 21:05:33     1.1
+++ linux-2.6.29.2/fs/minix/dir.c       2009/07/02 21:10:31
@@ -311,14 +311,18 @@ int minix_delete_entry(struct minix_dir_
        struct inode *inode = (struct inode*)mapping->host;
        char *kaddr = page_address(page);
        loff_t pos = page_offset(page) + (char*)de - kaddr;
-       unsigned len = minix_sb(inode->i_sb)->s_dirsize;
+       struct minix_sb_info *sbi = minix_sb(inode->i_sb);
+       unsigned len = sbi->s_dirsize;
        int err;

        lock_page(page);
        err = __minix_write_begin(NULL, mapping, pos, len,
                                        AOP_FLAG_UNINTERRUPTIBLE, &page, 
NULL);
        if (err == 0) {
-               de->inode = 0;
+               if (sbi->s_version == MINIX_V3)
+                       ((minix3_dirent *) de)->inode = 0;
+               else
+                       de->inode = 0;
                err = dir_commit_chunk(page, pos, len);
        } else {
                unlock_page(page);
@@ -443,7 +447,10 @@ void minix_set_link(struct minix_dir_ent
        err = __minix_write_begin(NULL, mapping, pos, sbi->s_dirsize,
                                        AOP_FLAG_UNINTERRUPTIBLE, &page, 
NULL);
        if (err == 0) {
-               de->inode = inode->i_ino;
+               if (sbi->s_version == MINIX_V3)
+                       ((minix3_dirent *) de)->inode = inode->i_ino;
+               else
+                       de->inode = inode->i_ino;
                err = dir_commit_chunk(page, pos, sbi->s_dirsize);
        } else {
                unlock_page(page);
@@ -473,7 +480,14 @@ ino_t minix_inode_by_name(struct dentry
        ino_t res = 0;

        if (de) {
-               res = de->inode;
+               struct address_space *mapping = page->mapping;
+               struct inode *inode = (struct inode*)mapping->host;
+               struct minix_sb_info *sbi = minix_sb(inode->i_sb);
+
+               if (sbi->s_version == MINIX_V3)
+                       res = ((minix3_dirent *) de)->inode;
+               else
+                       res = de->inode;
                dir_put_page(page);
        }
        return res;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/