lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1593428559-13920-1-git-send-email-anupam.al@samsung.com>
Date:   Mon, 29 Jun 2020 16:32:39 +0530
From:   Anupam Aggarwal <anupam.al@...sung.com>
To:     hirofumi@...l.parknet.co.jp
Cc:     linux-kernel@...r.kernel.org, a.sahrawat@...sung.com,
        Anupam Aggarwal <anupam.al@...sung.com>
Subject: [PATCH] fs: fat: add check for dir size in fat_calc_dir_size

Max directory size of FAT filesystem is FAT_MAX_DIR_SIZE(2097152 bytes)
It is possible that, due to corruption, directory size calculated in
fat_calc_dir_size() can be greater than FAT_MAX_DIR_SIZE, i.e.
can be in GBs, hence directory traversal can take long time.
for example when command "ls -lR" is executed on corrupted FAT
formatted USB, fat_search_long() function will lookup for a filename from
position 0 till end of corrupted directory size, multiple such lookups
will lead to long directory traversal

Added sanity check for directory size fat_calc_dir_size(),
and return EIO error, which will prevent lookup in corrupted directory

Signed-off-by: Anupam Aggarwal <anupam.al@...sung.com>
Signed-off-by: Amit Sahrawat <a.sahrawat@...sung.com>
---
 fs/fat/inode.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index a0cf99d..9b2e81e 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -490,6 +490,13 @@ static int fat_calc_dir_size(struct inode *inode)
 		return ret;
 	inode->i_size = (fclus + 1) << sbi->cluster_bits;
 
+	if (i_size_read(inode) > FAT_MAX_DIR_SIZE) {
+		fat_fs_error(inode->i_sb,
+			     "%s corrupted directory (invalid size %lld)\n",
+			     __func__, i_size_read(inode));
+		return -EIO;
+	}
+
 	return 0;
 }
 
-- 
1.9.1

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ