linux-kernel - [PATCH] brd: prevent overflow caused by too large rd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 22 Sep 2017 13:10:10 +0900
From:   Satoru Takeuchi <satoru.takeuchi@...il.com>
To:     linux-kernel@...r.kernel.org
Cc:     Jens Axboe <axboe@...nel.dk>, Jan Kara <jack@...e.cz>
Subject: [PATCH] brd: prevent overflow caused by too large rd_size parameter

The max value of rd_size parameter is ULONG_MAX from the following commit.

Commit 366f4aea649a65c3735d91b4409d84c771811290 ("brd: Switch rd_size
to unsigned long")

However, this parameter * 1024 will be set as inode->i_size corresponding
to brd devices and it's a signed value. To prevent overflow, this parameter
should be equal to or smaller than the max value of sector_t >> 11, 10 bits
are for 1024 and 1 bit is for sign bit.

Signed-off-by: Satoru Takeuchi <satoru.takeuchi@...il.com>
---
 drivers/block/brd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 104b71c..2b00e7d 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -546,6 +546,14 @@ static int __init brd_init(void)
 	 *	dynamically.
 	 */
 
+	/*
+	 * rd_size * 1024 will be set as its inode->i_size and it's a signed
+	 * value. So rd_size should be equal to or smaller than the max value
+	 * of sector_t >> 11, 10 bits are for 1024 and 1 bit is for sign bit.
+	 */
+	if (rd_size >> (sizeof(sector_t) * 8 - 11))
+		return -EINVAL;
+
 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
 		return -EIO;
 
-- 
2.7.4