linux-kernel - Re: Endless getdents() in vfat filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87a8qf2zbw.fsf@mail.parknet.co.jp>
Date:	Sun, 15 Nov 2015 21:59:15 +0900
From:	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Vegard Nossum <vegard.nossum@...cle.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Richard Weinberger <richard@....at>
Subject: Re: Endless getdents() in vfat filesystem

Richard Weinberger <richard@....at> writes:

>> It would be nice to have a proper patch description too. How about this?
>> 
>> """
>> For the root directory, . and .. are faked (using dir_emit_dots()) and
>> ctx->pos is reset from 2 to 0.
>> 
>> A corrupted root directory could cause fat_get_entry() to fail, but
>> ->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos
>> rewound to 0), so any following calls to ->iterate() continue to return
>> the same entries again and again.
>> 
>> The result is that userspace will never see the end of the directory,
>> causing e.g. 'ls' to hang in a getdents() loop.
>> """
>
> Agreed. And you deserve also a Reported-and-tested-by. :-)

Sounds good, updated patch here.
-- 
OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>



[PATCH v3] fat: Fix fake_offset handling on error path

For the root directory, . and .. are faked (using dir_emit_dots()) and
ctx->pos is reset from 2 to 0.

A corrupted root directory could cause fat_get_entry() to fail, but
->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos
rewound to 0), so any following calls to ->iterate() continue to return
the same entries again and again.

The result is that userspace will never see the end of the directory,
causing e.g. 'ls' to hang in a getdents() loop.

[hirofumi@...l.parknet.co.jp: cleanup and make sure to correct fake_offset]
Cc: stable@...r.kernel.org
Reported-and-tested-by: Vegard Nossum <vegard.nossum@...cle.com>
Signed-off-by: Richard Weinberger <richard.weinberger@...il.com>
Signed-off-by: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
---

 fs/fat/dir.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff -puN fs/fat/dir.c~fat-fake_offset-fix fs/fat/dir.c
--- linux/fs/fat/dir.c~fat-fake_offset-fix	2015-11-14 23:31:45.904700155 +0900
+++ linux-hirofumi/fs/fat/dir.c	2015-11-15 02:45:13.861256766 +0900
@@ -610,9 +610,9 @@ parse_record:
 		int status = fat_parse_long(inode, &cpos, &bh, &de,
 					    &unicode, &nr_slots);
 		if (status < 0) {
-			ctx->pos = cpos;
+			bh = NULL;
 			ret = status;
-			goto out;
+			goto end_of_dir;
 		} else if (status == PARSE_INVALID)
 			goto record_end;
 		else if (status == PARSE_NOT_LONGNAME)
@@ -654,8 +654,9 @@ parse_record:
 	fill_len = short_len;
 
 start_filldir:
-	if (!fake_offset)
-		ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+	ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+	if (fake_offset && ctx->pos < 2)
+		ctx->pos = 2;
 
 	if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) {
 		if (!dir_emit_dot(file, ctx))
@@ -681,14 +682,19 @@ record_end:
 	fake_offset = 0;
 	ctx->pos = cpos;
 	goto get_new;
+
 end_of_dir:
-	ctx->pos = cpos;
+	if (fake_offset && cpos < 2)
+		ctx->pos = 2;
+	else
+		ctx->pos = cpos;
 fill_failed:
 	brelse(bh);
 	if (unicode)
 		__putname(unicode);
 out:
 	mutex_unlock(&sbi->s_lock);
+
 	return ret;
 }
 
_
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/