linux-kernel - Re: xfs: verify inline directory data forks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdVpE2efAMNZzPs37jVnCWJz-jQqGPEhVx+8VFUNg+4yTg@mail.gmail.com>
Date:   Mon, 20 Mar 2017 10:41:16 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     "Darrick J. Wong" <darrick.wong@...cle.com>
Cc:     linux-xfs@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Christoph Hellwig <hch@...radead.org>
Subject: Re: xfs: verify inline directory data forks

On Thu, Mar 16, 2017 at 8:35 PM, Linux Kernel Mailing List
<linux-kernel@...r.kernel.org> wrote:
> Web:        https://git.kernel.org/torvalds/c/630a04e79dd41ff746b545d4fc052e0abb836120
> Commit:     630a04e79dd41ff746b545d4fc052e0abb836120
> Parent:     2fcc319d2467a5f5b78f35f79fd6e22741a31b1e
> Refname:    refs/heads/master
> Author:     Darrick J. Wong <darrick.wong@...cle.com>
> AuthorDate: Wed Mar 15 00:24:25 2017 -0700
> Committer:  Darrick J. Wong <darrick.wong@...cle.com>
> CommitDate: Wed Mar 15 00:24:25 2017 -0700
>
>     xfs: verify inline directory data forks
>
>     When we're reading or writing the data fork of an inline directory,
>     check the contents to make sure we're not overflowing buffers or eating
>     garbage data.  xfs/348 corrupts an inline symlink into an inline
>     directory, triggering a buffer overflow bug.
>
>     Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com>
>     Reviewed-by: Brian Foster <bfoster@...hat.com>

> --- a/fs/xfs/libxfs/xfs_dir2_sf.c
> +++ b/fs/xfs/libxfs/xfs_dir2_sf.c

> +/* Verify the consistency of an inline directory. */
> +int
> +xfs_dir2_sf_verify(
> +       struct xfs_mount                *mp,
> +       struct xfs_dir2_sf_hdr          *sfp,
> +       int                             size)
> +{

> +               /* Don't allow names with known bad length. */
> +               XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen > 0);
> +               XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen < MAXNAMELEN);

With gcc 4.1.2:

fs/xfs/libxfs/xfs_dir2_sf.c: In function ‘xfs_dir2_sf_verify’:
fs/xfs/libxfs/xfs_dir2_sf.c:680: warning: comparison is always true
due to limited range of data type

As sfep->namelen is __u8, and MAXNAMELEN = 256, none of the two checks
above can be true.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds