linux-kernel - Re: [PATCH] xfs: correct statx's result

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Jan 2019 12:04:24 -0600
From:   Eric Sandeen <sandeen@...deen.net>
To:     "Darrick J. Wong" <darrick.wong@...cle.com>,
        Su Yanjun <suyj.fnst@...fujitsu.com>
Cc:     linux-xfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        suyanjun218@...il.com
Subject: Re: [PATCH] xfs: correct statx's result_mask value



On 1/7/19 11:52 AM, Darrick J. Wong wrote:
> On Mon, Jan 07, 2019 at 04:53:10AM -0500, Su Yanjun wrote:
>> For statx syscall, xfs return the wrong result_mask.
>>
>> Signed-off-by: Su Yanjun <suyj.fnst@...fujitsu.com>
>> ---
>>  fs/xfs/xfs_iops.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
>> index f48ffd7..3811457 100644
>> --- a/fs/xfs/xfs_iops.c
>> +++ b/fs/xfs/xfs_iops.c
>> @@ -521,6 +521,9 @@ xfs_vn_getattr(
>>  			stat->btime.tv_nsec = ip->i_d.di_crtime.t_nsec;
>>  		}
>>  	}
>> +	
>> +	/* Only return mask that we care */
>> +	stat->result_mask &= request_mask;
> 
> Why not just:
> 
> 	stat->result_mask = STATX_BASIC_STATS;
> 
> at the top of the function?
> 
> I don't see the need to mask off result_mask at all, since we could some
> day elect to return more than what's in request_mask...
> 
> ...waitaminute, are you seeing garbage in the result_mask that's
> returned to userspace?  I also noticed the vfs stat functions declare
> "struct kstat stat;" without explicitly zeroing the structure fields,
> which means (I think) that we can leak stack information if the kernel
> isn't built with the stackleak plugin?

A clear problem statement and reproducer steps would be hugely useful
here.

-Eric