linux-ext4 - Re: [PATCH] ext2: strengthen value length check in ext2_xattr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190522095057.GH17019@quack2.suse.cz>
Date:   Wed, 22 May 2019 11:50:57 +0200
From:   Jan Kara <jack@...e.cz>
To:     Chengguang Xu <cgxu519@...o.com.cn>
Cc:     jack@...e.com, linux-ext4@...r.kernel.org
Subject: Re: [PATCH] ext2: strengthen value length check in ext2_xattr_set()

On Wed 22-05-19 16:28:46, Chengguang Xu wrote:
> Actually maximum length of a valid entry value is not
> ->s_blocksize because header, last entry and entry
> name will also occupy some spaces. This patch
> strengthens the value length check and return -ERANGE
> when the length is larger than allowed maximum length.
> 
> Signed-off-by: Chengguang Xu <cgxu519@...o.com.cn>

Thanks for the patch! But what's the point of this change? We would return
ERANGE instead of ENOSPC? I don't think that's serious enough to warrant
changing existing behavior...

> @@ -423,7 +423,10 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name,
>  	if (name == NULL)
>  		return -EINVAL;
>  	name_len = strlen(name);
> -	if (name_len > 255 || value_len > sb->s_blocksize)
> +	max_len = sb->s_blocksize - sizeof(struct ext2_xattr_header)
> +			- sizeof(__u32);
> +	if (name_len > 255 ||
> +	    EXT2_XATTR_LEN(name_len) + EXT2_XATTR_SIZE(value_len) > max_len)
>  		return -ERANGE;
>  	down_write(&EXT2_I(inode)->xattr_sem);
>  	if (EXT2_I(inode)->i_file_acl) {

								Honza

-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR