linux-kernel - Re: [PATCH] jffs2: prevent xattr node from overflowing the eraseblock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <74f2b16a-dd48-4306-b28b-ad5ba77d8bfe@elkcl.ru>
Date: Mon, 15 Apr 2024 19:50:23 +0300
From: Ilya Denisyev <dev@...cl.ru>
To: Christian Brauner <brauner@...nel.org>
Cc: David Woodhouse <dwmw2@...radead.org>, Richard Weinberger
 <richard@....at>, Zhihao Cheng <chengzhihao1@...wei.com>,
 Fabian Frederick <fabf@...net.be>, Nick Desaulniers
 <ndesaulniers@...gle.com>, Wedson Almeida Filho <walmeida@...rosoft.com>,
 KaiGai Kohei <kaigai@...jp.nec.com>, linux-mtd@...ts.infradead.org,
 linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org
Subject: Re: [PATCH] jffs2: prevent xattr node from overflowing the eraseblock

On 15.04.2024 17:28, Christian Brauner wrote:
> Can this overflow? I.e. can c->sector_size be smaller than c->cleanmarker_size?

I'm pretty sure that it can't. As far as I know, c->sector_size is at 
least the MTD eraseblock size[1] or even bigger in the case of 
DataFlash[2]. The cleanmarker is either the size of the smallest JFFS2 
node[3] (currently 12 bytes), 0 bytes for certain flash types (like 
NAND, where it's stored out of band[4]) or apparently at most the MTD 
writesize (which, as far as I understand, is not larger than the 
erasesize) for Intel Sibley[5].

Considering that any JFFS2 node must fit inside one block and that the 
cleanmarker is the smallest node there is (if it's even a proper node), 
it shouldn't overflow, otherwise JFFS2 won't work in the first place.

[1] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/fs.c#L539

[2] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1253

[3] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/fs.c#L557

[4] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1190

[5] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1296

---

Best regards,

Ilya