linux-kernel - Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180731173136.rnhzvvvt3wtt2xdg@treble>
Date:   Tue, 31 Jul 2018 12:31:36 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Andreas Dilger <adilger@...ger.ca>
Cc:     Jeremy Cline <jcline@...hat.com>, Theodore Ts'o <tytso@....edu>,
        linux-ext4 <linux-ext4@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable@...r.kernel.org
Subject: Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

On Tue, Jul 31, 2018 at 12:39:41AM -0600, Andreas Dilger wrote:
> > Also it looks like XQM_MAXQUOTAS, MAXQUOTAS, and EXT4_MAXQUOTAS all
> > have the same value (3).  Maybe they can be consolidated to just use
> > MAXQUOTAS everywhere?
> 
> No, the filesystem-specific MAXQUOTAS values were separated from
> the kernel MAXQUOTAS value for a good reason.  This allows some
> filesystems to support new quota types (e.g. project quotas) that
> not all other filesystems can handle.  This may potentially change
> again in the future, so they shouldn't be tightly coupled.

But isn't that what sb->s_quota_types is for?  To allow different
filesystems to support different quota types?

Also I don't see any bounds checks for EXT4_MAXQUOTAS.  It seems like
the ext4 code assumes that MAXQUOTAS and EXT4_MAXQUOTAS are the same.

-- 
Josh