kevin/linux
1
Fork 0
Code

ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

Browse Source 
xattr in ocfs2 maybe 'non-indexed', which saved with additional space
requested.  It's better to check if the memory is out of bound before
memcmp, although this possibility mainly comes from crafted poisonous
images.

Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.com
Signed-off-by: Ferry Meng <mengferry@linux.alibaba.com>
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: lei lu <llfamsec@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Ferry Meng 2024-05-20 10:40:24 +08:00 committed by Andrew Morton
parent 9e3041fecd
commit af77c4fc18
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
fs/ocfs2/xattr.c
View File

@ -1068,7 +1068,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index,
{ {
struct ocfs2_xattr_entry *entry; struct ocfs2_xattr_entry *entry;
size_t name_len; size_t name_len;
int i, cmp = 1; int i, name_offset, cmp = 1;
if (name == NULL) if (name == NULL)
return -EINVAL; return -EINVAL;
@ -1083,10 +1083,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index,
cmp = name_index - ocfs2_xattr_get_type(entry); cmp = name_index - ocfs2_xattr_get_type(entry);
if (!cmp) if (!cmp)
cmp = name_len - entry->xe_name_len; cmp = name_len - entry->xe_name_len;
if (!cmp) if (!cmp) {
cmp = memcmp(name, (xs->base + name_offset = le16_to_cpu(entry->xe_name_offset);
le16_to_cpu(entry->xe_name_offset)), if ((xs->base + name_offset + name_len) > xs->end) {
name_len); ocfs2_error(inode->i_sb,
"corrupted xattr entries");
return -EFSCORRUPTED;
}
cmp = memcmp(name, (xs->base + name_offset), name_len);
}
if (cmp == 0) if (cmp == 0)
break; break;
entry += 1; entry += 1;