linux-ext4 - Re: [PATCH] ext3/4: fix uninitialized bs in ext3/4_xattr_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4828FD68.40608@oracle.com>
Date:	Tue, 13 May 2008 10:31:04 +0800
From:	Tiger Yang <tiger.yang@...cle.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
CC:	linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, Andreas Gruenbacher <agruen@...e.de>,
	stable@...nel.org
Subject: Re: [PATCH] ext3/4: fix uninitialized bs in ext3/4_xattr_set_handle()

Hi, Andrew

This situation only happens we format ext3/4 with inode size more than 
128 and we have put xattr entries both in ibody and block.
The consequences about this bug is we will lost the xattr block which 
pointed by i_file_acl with all xattr entires in it. We will alloc a new 
xattr block and put that large value entry in it. The old xattr block 
will become orphan block.

Best regards,
tiger

Andrew Morton wrote:
> On Mon, 12 May 2008 11:24:40 +0800
> Tiger Yang <tiger.yang@...cle.com> wrote:
>
>   
>> I met a bug when I try to replace a xattr entry in ibody with a big size 
>> value. But in ibody there has no space for the new value. So it should 
>> set new xattr entry in block and remove the old xattr entry in ibody.
>>
>> Best regards,
>> tiger
>>
>>
>> [xattr.patch  text/x-patch (1.3KB)]
>> This fix the uninitialized bs when we try to replace a xattr entry in ibody with the new value which require more than free space.
>>
>> Signed-off-by: Tiger Yang <tiger.yang@...cle.com>
>>
>> diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
>> index a6ea4d6..e1af9bd 100644
>> --- a/fs/ext3/xattr.c
>> +++ b/fs/ext3/xattr.c
>> @@ -1000,6 +1000,11 @@ ext3_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
>>  			i.value = NULL;
>>  			error = ext3_xattr_block_set(handle, inode, &i, &bs);
>>  		} else if (error == -ENOSPC) {
>> +			if (EXT3_I(inode)->i_file_acl && !bs.s.base) {
>> +				error = ext3_xattr_block_find(inode, &i, &bs);
>> +				if (error)
>> +					goto cleanup;
>> +			}
>>  			error = ext3_xattr_block_set(handle, inode, &i, &bs);
>>  			if (error)
>>  				goto cleanup;
>>     
>
> That sounds fairly bad.
>
> What are the consequences of this bug, when someone hits it?
>
> It appears that we should backport this fix into 2.6.25.x (and perhaps
> earlier).  What do you think?
>
>   
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html