linux-kernel - [PATCH] fuse: Fix IOC_[GS]ETFLAGS argument size brokenness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 Dec 2013 15:27:39 -0800
From:	"Darrick J. Wong" <darrick.wong@...cle.com>
To:	Miklos Szeredi <miklos@...redi.hu>,
	Alexander Viro <viro@...iv.linux.org.uk>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	fuse-devel@...ts.sourceforge.net
Subject: [PATCH] fuse: Fix IOC_[GS]ETFLAGS argument size brokenness

The IOC_[GS]ETFLAGS ioctls, despite being defined to take a "long"
parameter, actually take "int" parameters.  FUSE unfortunately assumed
that the ioctl definitions never lie, and transfers a long's worth of
data in and out of userspace, which causes stack smashing in chattr,
and other bugs elsewhere.

So, special-case this in FUSE, and document this int/long quirk in
include/uapi/linux/fs.h.

Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com>
---
 fs/fuse/file.c          |   11 +++++++++++
 include/uapi/linux/fs.h |    1 +
 2 files changed, 12 insertions(+)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 7e70506..5fa8181 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2385,6 +2385,17 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 		iov->iov_base = (void __user *)arg;
 		iov->iov_len = _IOC_SIZE(cmd);
 
+		/*
+		 * The IOC_[GS]ETFLAGS ioctls take int parameters even though
+		 * the ioctl definition specifies long.  Userland has been
+		 * expecting int for ages (and chattr segfaults on FUSE
+		 * filesystems), so special case that here.  The IOC32
+		 * variants were declared with int, so they don't need this.
+		 */
+		if (cmd == FS_IOC_GETFLAGS || cmd == FS_IOC_SETFLAGS) {
+			iov->iov_len = sizeof(int);
+		}
+
 		if (_IOC_DIR(cmd) & _IOC_WRITE) {
 			in_iov = iov;
 			in_iovs = 1;
diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
index 6c28b61..bc8aa8e 100644
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -154,6 +154,7 @@ struct inodes_stat_t {
 #define FITHAW		_IOWR('X', 120, int)	/* Thaw */
 #define FITRIM		_IOWR('X', 121, struct fstrim_range)	/* Trim */
 
+/* IOC_[GS]ETFLAGS take an int argument despite being defined to take long. */
 #define	FS_IOC_GETFLAGS			_IOR('f', 1, long)
 #define	FS_IOC_SETFLAGS			_IOW('f', 2, long)
 #define	FS_IOC_GETVERSION		_IOR('v', 1, long)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/