linux-kernel - Re: [PATCH] ubifs: Fix potentially out-of-bounds memory access in ubifs_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAFLxGvyU=zh23vkYiAGRzyd4LGJodLwRRa1S03THAoSaSL=dGA@mail.gmail.com>
Date:   Sun, 12 Jan 2020 23:49:13 +0100
From:   Richard Weinberger <richard.weinberger@...il.com>
To:     Liu Song <fishland@...yun.com>
Cc:     Richard Weinberger <richard@....at>, linux-mtd@...ts.infradead.org,
        LKML <linux-kernel@...r.kernel.org>, liu.song11@....com.cn
Subject: Re: [PATCH] ubifs: Fix potentially out-of-bounds memory access in ubifs_dump_node

On Mon, Dec 16, 2019 at 4:45 PM Liu Song <fishland@...yun.com> wrote:
>
> From: Liu Song <liu.song11@....com.cn>
>
> In “ubifs_check_node”, when “node_len + offs> c-> leb_size”, then
> goto label of "out_len". Then, in the following "ubifs_dump_node",
> if inode type is "UBIFS_DATA_NODE", in "print_hex_dump", an
> out-of-bounds access may occur due to the wrong "ch->len".
> We encountered this problem in our environment. If "ch-> len" is
> very large, it may even cause the kernel to crash.
>
> There are three reasons to choose to remove "print_hex_dump".
> 1) As mentioned earlier, the exception "ch-> len" may cause an
> exception in "print_hex_dump";
> 2) Data nodes are often large. When printing data content in
> "print_hex_dump", a large amount of output will bring a high load
> on the system, and may even cause a watchdog reset;
> 3) Even if there is a CRC check error, the stuff of file is difficult
> to identify, and difficult to find the problem from a large amount of
> output. We have already output the LEB and offset of the node. So we
> can take the initiative to view the data of interest, instead of
> printing it directly.

If UBIFS dumps data nodes due an error we are already in deep trouble
and having the content of bad data nodes can be helpful.
This feature helped me more than once to debug issues.

-- 
Thanks,
//richard