linux-ext4 - Re: [PATCH 2/3] ext4: don't read out of bounds when checking for in-inode xattrs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <9D7DBB36-D40D-419B-B150-5F79C3A07119@dilger.ca>
Date:   Mon, 28 Nov 2016 12:43:55 -0700
From:   Andreas Dilger <adilger@...ger.ca>
To:     Eric Biggers <ebiggers@...gle.com>
Cc:     linux-ext4@...r.kernel.org, Theodore Ts'o <tytso@....edu>,
        Andreas Dilger <adilger.kernel@...ger.ca>
Subject: Re: [PATCH 2/3] ext4: don't read out of bounds when checking for in-inode xattrs

On Nov 26, 2016, at 11:39 PM, Eric Biggers <ebiggers@...gle.com> wrote:
> 
> With i_extra_isize equal to or close to the available space, it was
> possible for us to read past the end of the inode when trying to detect
> or validate in-inode xattrs.  Fix this by checking for the needed extra
> space first.
> 
> This patch shouldn't have any noticeable effect on
> non-corrupted/non-malicious filesystems.
> 
> Signed-off-by: Eric Biggers <ebiggers@...gle.com>

Except for minor style issues (below), looks fine.

Reviewed-by: Andreas Dilger <adilger@...ger.ca>

> ---
> fs/ext4/inode.c | 4 +++-
> fs/ext4/xattr.c | 5 ++---
> 2 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index bc99ebe..e52f41a 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -4519,7 +4519,9 @@ static inline void ext4_iget_extra_inode(struct inode *inode,
> {
> 	__le32 *magic = (void *)raw_inode +
> 			EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
> -	if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
> +	if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32)
> +			<= EXT4_INODE_SIZE(inode->i_sb) &&

(style) operators should go at the end of the previous continued line
(style) continued line should align after first '(' on previous line

> +	    *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
> 		ext4_set_inode_state(inode, EXT4_STATE_XATTR);
> 		ext4_find_inline_data_nolock(inode);
> 	} else
> diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
> index 1846e91..59c9ec7 100644
> --- a/fs/ext4/xattr.c
> +++ b/fs/ext4/xattr.c
> @@ -231,13 +231,12 @@ static int
> __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header,
> 			 void *end, const char *function, unsigned int line)
> {
> -	struct ext4_xattr_entry *entry = IFIRST(header);
> 	int error = -EFSCORRUPTED;
> 
> -	if (((void *) header >= end) ||
> +	if (end - (void *)header < sizeof(*header) + sizeof(u32) ||
> 	    (header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)))
> 		goto errout;
> -	error = ext4_xattr_check_names(entry, end, entry);
> +	error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
> errout:
> 	if (error)
> 		__ext4_error_inode(inode, function, line, 0,
> --
> 2.8.0.rc3.226.g39d4020
> 


Cheers, Andreas






Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)