On Nov 26, 2016, at 11:39 PM, Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
>
> With i_extra_isize equal to or close to the available space, it was
> possible for us to read past the end of the inode when trying to detect
> or validate in-inode xattrs. Fix this by checking for the needed extra
> space first.
>
> This patch shouldn't have any noticeable effect on
> non-corrupted/non-malicious filesystems.
>
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
Except for minor style issues (below), looks fine.
Reviewed-by: Andreas Dilger <adilger@xxxxxxxxx>
> ---
> fs/ext4/inode.c | 4 +++-
> fs/ext4/xattr.c | 5 ++---
> 2 files changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index bc99ebe..e52f41a 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -4519,7 +4519,9 @@ static inline void ext4_iget_extra_inode(struct inode *inode,
> {
> __le32 *magic = (void *)raw_inode +
> EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
> - if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
> + if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32)
> + <= EXT4_INODE_SIZE(inode->i_sb) &&
(style) operators should go at the end of the previous continued line
(style) continued line should align after first '(' on previous line
> + *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
> ext4_set_inode_state(inode, EXT4_STATE_XATTR);
> ext4_find_inline_data_nolock(inode);
> } else
> diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
> index 1846e91..59c9ec7 100644
> --- a/fs/ext4/xattr.c
> +++ b/fs/ext4/xattr.c
> @@ -231,13 +231,12 @@ static int
> __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header,
> void *end, const char *function, unsigned int line)
> {
> - struct ext4_xattr_entry *entry = IFIRST(header);
> int error = -EFSCORRUPTED;
>
> - if (((void *) header >= end) ||
> + if (end - (void *)header < sizeof(*header) + sizeof(u32) ||
> (header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)))
> goto errout;
> - error = ext4_xattr_check_names(entry, end, entry);
> + error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
> errout:
> if (error)
> __ext4_error_inode(inode, function, line, 0,
> --
> 2.8.0.rc3.226.g39d4020
>
Cheers, Andreas
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
