lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Fri, 10 May 2019 20:46:18 -0600
From:   Andreas Dilger <adilger@...ger.ca>
To:     Chengguang Xu <cgxu519@...il.com>
Cc:     jack@...e.com, linux-ext4@...r.kernel.org
Subject: Re: [PATCH 2/2] ext2: introduce helper for xattr entry validation

Similarly, this would be more useful if it took the blocksize directly as an
argument rather than the inode. That would allow it to be used to check
entries in the extended inode space or an external inode. 

Cheers, Andreas

> On May 10, 2019, at 04:37, Chengguang Xu <cgxu519@...il.com> wrote:
> 
> Introduce helper function ext2_xattr_entry_valid()
> for xattr entry validation and clean up the entry
> check ralated code.
> 
> Signed-off-by: Chengguang Xu <cgxu519@...il.com>
> ---
> fs/ext2/xattr.c | 22 ++++++++++++++++------
> 1 file changed, 16 insertions(+), 6 deletions(-)
> 
> diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
> index 6e0b2b0f333f..e40fff8ab543 100644
> --- a/fs/ext2/xattr.c
> +++ b/fs/ext2/xattr.c
> @@ -144,6 +144,20 @@ ext2_xattr_header_valid(struct buffer_head *bh)
>   return true;
> }
> 
> +static bool
> +ext2_xattr_entry_valid(struct inode *inode, struct ext2_xattr_entry *entry,
> +               size_t size)
> +{
> +    if (entry->e_value_block != 0)
> +        return false;
> +
> +    if (size > inode->i_sb->s_blocksize ||
> +        le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
> +        return false;
> +
> +    return true;
> +}
> +
> /*
> * ext2_xattr_get()
> *
> @@ -214,11 +228,8 @@ ext2_xattr_get(struct inode *inode, int name_index, const char *name,
>   goto cleanup;
> found:
>   /* check the buffer size */
> -    if (entry->e_value_block != 0)
> -        goto bad_block;
>   size = le32_to_cpu(entry->e_value_size);
> -    if (size > inode->i_sb->s_blocksize ||
> -        le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
> +    if (!ext2_xattr_entry_valid(inode, entry, size))
>       goto bad_block;
> 
>   if (ext2_xattr_cache_insert(ea_block_cache, bh))
> @@ -483,8 +494,7 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name,
>       if (!here->e_value_block && here->e_value_size) {
>           size_t size = le32_to_cpu(here->e_value_size);
> 
> -            if (le16_to_cpu(here->e_value_offs) + size > 
> -                sb->s_blocksize || size > sb->s_blocksize)
> +            if (!ext2_xattr_entry_valid(inode, here, size))
>               goto bad_block;
>           free += EXT2_XATTR_SIZE(size);
>       }
> -- 
> 2.20.1
> 

Powered by blists - more mailing lists