linux-kernel - Re: [PATCH 1/4] befs: check allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 12 Aug 2016 10:38:58 +0100
From:	Luis de Bethencourt <luisbg@....samsung.com>
To:	Salah Triki <salah.triki@...il.com>
CC:	akpm@...ux-foundation.org, viro@...iv.linux.org.uk,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] befs: check allocation_group number before use

On 12/08/16 08:26, Salah Triki wrote:
> On Thu, Aug 11, 2016 at 11:56:16AM +0100, Luis de Bethencourt wrote:
>> On 10/08/16 23:12, Salah Triki wrote:
>>> Check that the allocation group number is not greater or equal to the
>>> number of allocations group in the file system and return BEF_ERR in the
>>> case of error.
>>>
>>> Signed-off-by: Salah Triki <salah.triki@...il.com>
>>> ---
>>>  fs/befs/befs.h | 5 +++++
>>>  1 file changed, 5 insertions(+)
>>>
>>> diff --git a/fs/befs/befs.h b/fs/befs/befs.h
>>> index 55f3ea2..6daf4c4 100644
>>> --- a/fs/befs/befs.h
>>> +++ b/fs/befs/befs.h
>>> @@ -121,6 +121,11 @@ BEFS_I(const struct inode *inode)
>>>  static inline befs_blocknr_t
>>>  iaddr2blockno(struct super_block *sb, const befs_inode_addr *iaddr)
>>>  {
>>> +	if (iaddr->allocation_group >= BEFS_SB(sb)->num_ags) {
>>> +		befs_error(sb, "BEFS: Invalid allocation group %u, max is %u",
>>> +			   iaddr->allocation_group, BEFS_SB(sb)->num_ags);
>>> +		return BEFS_ERR;
>>> +	}
>>>  	return ((iaddr->allocation_group << BEFS_SB(sb)->ag_shift) +
>>>  		iaddr->start);
>>>  }
>>>
>>
>> Hi Salah,
>>
>> To understand why would we check for this. When can this error happen? I mean,
>> when can iaddr2blockno() be called with an out of bounds allocation group?
>>
>> Thanks,
>> Luis
> 
> Hi Luis,
> 
> allocation group number is set to blockno >> BEFS_SB(sb)->ag_shift by 
> blockno2iaddr(), so if ag_shift is not valid, an out of bound may occur. 
> By now, thanx to your question ;), I think it's better to check the validity 
> of ag_shift when the superblock is loaded.
> 
> Nack.
> 
> Thanx for the question :)
> Salah 
> 

No problem :)

I will assume the Nack covers patch 1 to 3. Since they are all related.

Enjoy the weekend,
Luis