linux-kernel - [PATCH] ext4: pass strlen() of the symlink instead of i_size to inode_set_cached

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250205162819.380864-1-mjguzik@gmail.com>
Date: Wed,  5 Feb 2025 17:28:19 +0100
From: Mateusz Guzik <mjguzik@...il.com>
To: brauner@...nel.org,
	tytso@....edu
Cc: kees@...nel.org,
	viro@...iv.linux.org.uk,
	jack@...e.cz,
	linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	Mateusz Guzik <mjguzik@...il.com>,
	syzbot+48a99e426f29859818c0@...kaller.appspotmail.com
Subject: [PATCH] ext4: pass strlen() of the symlink instead of i_size to inode_set_cached_link()

The call to nd_terminate_link() clamps the size to min(i_size,
sizeof(ei->i_data) - 1), while the subsequent call to
inode_set_cached_link() fails the possible update.

The kernel used to always strlen(), so do it now as well.

Reported-by: syzbot+48a99e426f29859818c0@...kaller.appspotmail.com
Fixes: bae80473f7b0 ("ext4: use inode_set_cached_link()")
Signed-off-by: Mateusz Guzik <mjguzik@...il.com>
---

Per my comments in:
https://lore.kernel.org/all/CAGudoHEv+Diti3r0x9VmF5ixgRVKk4trYnX_skVJNkQoTMaDHg@mail.gmail.com/#t

There is definitely a pre-existing bug in ext4 which the above happens
to run into. I suspect the nd_terminate_link thing will disappear once
that gets sorted out.

In the meantime the appropriate fix for 6.14 is to restore the original
behavior of issuing strlen.

syzbot verified the issue is fixed:
https://lore.kernel.org/linux-hardening/67a381a3.050a0220.50516.0077.GAE@google.com/T/#m340e6b52b9547ac85471a1da5980fe0a67c790ac

 fs/ext4/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7c54ae5fcbd4..30cff983e601 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5010,7 +5010,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
 			nd_terminate_link(ei->i_data, inode->i_size,
 				sizeof(ei->i_data) - 1);
 			inode_set_cached_link(inode, (char *)ei->i_data,
-					      inode->i_size);
+					      strlen((char *)ei->i_data));
 		} else {
 			inode->i_op = &ext4_symlink_inode_operations;
 		}
-- 
2.43.0