linux-kernel - Re: [PATCH] ext3/4: fix uninitialized bs in ext3/4_xattr_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <1210668492.4016.6.camel@localhost>
Date:	Tue, 13 May 2008 14:18:12 +0530
From:	Kalpak Shah <Kalpak.Shah@....COM>
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	Tiger Yang <tiger.yang@...cle.com>, linux-ext4@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ext3/4: fix uninitialized bs in	ext3/4_xattr_set_handle()

Hi Eric,

On Mon, 2008-05-12 at 19:18 -0500, Eric Sandeen wrote:
> Tiger Yang wrote:
> > Hi,
> > I met a bug when I try to replace a xattr entry in ibody with a big size 
> > value. But in ibody there has no space for the new value. So it should 
> > set new xattr entry in block and remove the old xattr entry in ibody.
> > 
> > Best regards,
> > tiger
> > 
> 
> Tiger, do you have a testcase handy to demonstrate this?

Attached is a simple script to reproduce the problem.

> 
> Is the new, large out-of-inode xattr unique so that it does not match
> any existing attribute block, I assume?

I don't quite understand what you mean but the problem is that in
ext3_xattr_set_handle(), the EA being replaced is found in the
inode-body (by function ext3_xattr_ibody_find) and hence
ext3_xattr_block_find() is not called initially. So in this test-case
when we have to delete an EA from the inode and add it into the external
block, bs turns out to be uninitialized and therefore a new EA block
gets allocated instead of the existing one being used.

Thanks,
Kalpak

> 
> Thanks,
> 
> -Eric
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Download attachment "reproducer.sh" of type "application/x-shellscript" (1019 bytes)