On 5/23/24 6:13 AM, Andrew Morton wrote: > The patch titled > Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() > has been added to the -mm mm-nonmm-unstable branch. Its filename is > ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch > > This patch will shortly appear at > https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch > > This patch will later appear in the mm-nonmm-unstable branch at > git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > > Before you just go and hit "reply", please: > a) Consider who else should be cc'ed > b) Prefer to cc a suitable mailing list as well > c) Ideally: find the original patch on the mailing list and do a > reply-to-all to that, adding suitable additional cc's > > *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** > > The -mm tree is included into linux-next via the mm-everything > branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > and is updated there every 2-3 working days > > ------------------------------------------------------ > From: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx> > Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() > Date: Mon, 20 May 2024 10:40:24 +0800 > > xattr in ocfs2 maybe 'non-indexed', which saved with additional space > requested. It's better to check if the memory is out of bound before > memcmp, although this possibility mainly comes from crafted poisonous > images. > > Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@xxxxxxxxxxxxxxxxx > Signed-off-by: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx> > Signed-off-by-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> A typo here. s/Signed-off-by-by/Signed-off-by > Reported-by: lei lu <llfamsec@xxxxxxxxx> > Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> > Cc: Changwei Ge <gechangwei@xxxxxxx> > Cc: Gang He <ghe@xxxxxxxx> > Cc: Joel Becker <jlbec@xxxxxxxxxxxx> > Cc: Jun Piao <piaojun@xxxxxxxxxx> > Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx> > Cc: Mark Fasheh <mark@xxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > --- > > fs/ocfs2/xattr.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > --- a/fs/ocfs2/xattr.c~ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry > +++ a/fs/ocfs2/xattr.c > @@ -1068,7 +1068,7 @@ static int ocfs2_xattr_find_entry(struct > { > struct ocfs2_xattr_entry *entry; > size_t name_len; > - int i, cmp = 1; > + int i, name_offset, cmp = 1; > > if (name == NULL) > return -EINVAL; > @@ -1083,10 +1083,15 @@ static int ocfs2_xattr_find_entry(struct > cmp = name_index - ocfs2_xattr_get_type(entry); > if (!cmp) > cmp = name_len - entry->xe_name_len; > - if (!cmp) > - cmp = memcmp(name, (xs->base + > - le16_to_cpu(entry->xe_name_offset)), > - name_len); > + if (!cmp) { > + name_offset = le16_to_cpu(entry->xe_name_offset); > + if ((xs->base + name_offset + name_len) > xs->end) { > + ocfs2_error(inode->i_sb, > + "corrupted xattr entries"); > + return -EFSCORRUPTED; > + } > + cmp = memcmp(name, (xs->base + name_offset), name_len); > + } > if (cmp == 0) > break; > entry += 1; > _ > > Patches currently in -mm which might be from mengferry@xxxxxxxxxxxxxxxxx are > > ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch > ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch
