linux-ext4 - [PATCH 2/2] ext2: introduce helper for xattr entry validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1557484666-23562-2-git-send-email-cgxu519@gmail.com>
Date:   Fri, 10 May 2019 18:37:46 +0800
From:   Chengguang Xu <cgxu519@...il.com>
To:     jack@...e.com
Cc:     linux-ext4@...r.kernel.org, Chengguang Xu <cgxu519@...il.com>
Subject: [PATCH 2/2] ext2: introduce helper for xattr entry validation

Introduce helper function ext2_xattr_entry_valid()
for xattr entry validation and clean up the entry
check ralated code.

Signed-off-by: Chengguang Xu <cgxu519@...il.com>
---
 fs/ext2/xattr.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index 6e0b2b0f333f..e40fff8ab543 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -144,6 +144,20 @@ ext2_xattr_header_valid(struct buffer_head *bh)
 	return true;
 }
 
+static bool
+ext2_xattr_entry_valid(struct inode *inode, struct ext2_xattr_entry *entry,
+		       size_t size)
+{
+	if (entry->e_value_block != 0)
+		return false;
+
+	if (size > inode->i_sb->s_blocksize ||
+	    le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
+		return false;
+
+	return true;
+}
+
 /*
  * ext2_xattr_get()
  *
@@ -214,11 +228,8 @@ ext2_xattr_get(struct inode *inode, int name_index, const char *name,
 	goto cleanup;
 found:
 	/* check the buffer size */
-	if (entry->e_value_block != 0)
-		goto bad_block;
 	size = le32_to_cpu(entry->e_value_size);
-	if (size > inode->i_sb->s_blocksize ||
-	    le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
+	if (!ext2_xattr_entry_valid(inode, entry, size))
 		goto bad_block;
 
 	if (ext2_xattr_cache_insert(ea_block_cache, bh))
@@ -483,8 +494,7 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name,
 		if (!here->e_value_block && here->e_value_size) {
 			size_t size = le32_to_cpu(here->e_value_size);
 
-			if (le16_to_cpu(here->e_value_offs) + size > 
-			    sb->s_blocksize || size > sb->s_blocksize)
+			if (!ext2_xattr_entry_valid(inode, here, size))
 				goto bad_block;
 			free += EXT2_XATTR_SIZE(size);
 		}
-- 
2.20.1