linux-ext4 - patch ext3-4-fix-uninitialized-bs-in-ext3-4_xattr_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080515195017.8C4AD14540CB@imap.suse.de>
Date:	Thu, 15 May 2008 12:04:45 -0700
From:	<gregkh@...e.de>
To:	tiger.yang@...cle.com, adilger@....com, agruen@...e.de,
	akpm@...ux-foundation.org, gregkh@...e.de,
	linux-ext4@...r.kernel.org, torvalds@...ux-foundation.org
Cc:	<stable@...nel.org>, <stable-commits@...r.kernel.org>
Subject: patch ext3-4-fix-uninitialized-bs-in-ext3-4_xattr_set_handle.patch added to 2.6.25-stable tree


This is a note to let you know that we have just queued up the patch titled

     Subject: ext3/4: fix uninitialized bs in ext3/4_xattr_set_handle()

to the 2.6.25-stable tree.  Its filename is

     ext3-4-fix-uninitialized-bs-in-ext3-4_xattr_set_handle.patch

A git repo of this tree can be found at 
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary


>From stable-bounces@...ux.kernel.org Wed May 14 19:45:26 2008
From: Tiger Yang <tiger.yang@...cle.com>
Date: Thu, 15 May 2008 02:45:18 GMT
Subject: ext3/4: fix uninitialized bs in ext3/4_xattr_set_handle()
To: jejb@...nel.org, stable@...nel.org
Message-ID: <200805150245.m4F2jI8E020348@...a.kernel.org>

From: Tiger Yang <tiger.yang@...cle.com>

commit 7e01c8e5420b6c7f9d85d34c15d8c7a15c9fc720 upstream

This fix the uninitialized bs when we try to replace a xattr entry in
ibody with the new value which require more than free space.

This situation only happens we format ext3/4 with inode size more than 128 and
we have put xattr entries both in ibody and block.  The consequences about
this bug is we will lost the xattr block which pointed by i_file_acl with all
xattr entires in it.  We will alloc a new xattr block and put that large value
entry in it.  The old xattr block will become orphan block.

Signed-off-by: Tiger Yang <tiger.yang@...cle.com>
Cc: <linux-ext4@...r.kernel.org>
Cc: Andreas Gruenbacher <agruen@...e.de>
Acked-by: Andreas Dilger <adilger@....com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>

---
 fs/ext3/xattr.c |    5 +++++
 fs/ext4/xattr.c |    5 +++++
 2 files changed, 10 insertions(+)

--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -1000,6 +1000,11 @@ ext3_xattr_set_handle(handle_t *handle, 
 			i.value = NULL;
 			error = ext3_xattr_block_set(handle, inode, &i, &bs);
 		} else if (error == -ENOSPC) {
+			if (EXT3_I(inode)->i_file_acl && !bs.s.base) {
+				error = ext3_xattr_block_find(inode, &i, &bs);
+				if (error)
+					goto cleanup;
+			}
 			error = ext3_xattr_block_set(handle, inode, &i, &bs);
 			if (error)
 				goto cleanup;
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1011,6 +1011,11 @@ ext4_xattr_set_handle(handle_t *handle, 
 			i.value = NULL;
 			error = ext4_xattr_block_set(handle, inode, &i, &bs);
 		} else if (error == -ENOSPC) {
+			if (EXT4_I(inode)->i_file_acl && !bs.s.base) {
+				error = ext4_xattr_block_find(inode, &i, &bs);
+				if (error)
+					goto cleanup;
+			}
 			error = ext4_xattr_block_set(handle, inode, &i, &bs);
 			if (error)
 				goto cleanup;


Patches currently in stable-queue which might be from tiger.yang@...cle.com are

queue-2.6.25/ext3-4-fix-uninitialized-bs-in-ext3-4_xattr_set_handle.patch
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html