On 5/23/24 6:13 AM, Andrew Morton wrote: > The patch titled > Subject: ocfs2: add bounds checking to ocfs2_xattr_find_entry() > has been added to the -mm mm-nonmm-unstable branch. Its filename is > ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch > > This patch will shortly appear at > https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch > > This patch will later appear in the mm-nonmm-unstable branch at > git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > > Before you just go and hit "reply", please: > a) Consider who else should be cc'ed > b) Prefer to cc a suitable mailing list as well > c) Ideally: find the original patch on the mailing list and do a > reply-to-all to that, adding suitable additional cc's > > *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** > > The -mm tree is included into linux-next via the mm-everything > branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > and is updated there every 2-3 working days > > ------------------------------------------------------ > From: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx> > Subject: ocfs2: add bounds checking to ocfs2_xattr_find_entry() > Date: Mon, 20 May 2024 10:40:23 +0800 > > Add a paranoia check to make sure it doesn't stray beyond valid memory > region containing ocfs2 xattr entries when scanning for a match. It will > prevent out-of-bound access in case of crafted images. > > Link: https://lkml.kernel.org/r/20240520024024.1976129-1-joseph.qi@xxxxxxxxxxxxxxxxx > Signed-off-by: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx> > Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>Reported-by: lei lu <llfamsec@xxxxxxxxx> Seems malformed. > Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> > Cc: Mark Fasheh <mark@xxxxxxxxxx> > Cc: Joel Becker <jlbec@xxxxxxxxxxxx> > Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx> > Cc: Changwei Ge <gechangwei@xxxxxxx> > Cc: Gang He <ghe@xxxxxxxx> > Cc: Jun Piao <piaojun@xxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > --- > > fs/ocfs2/xattr.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > > --- a/fs/ocfs2/xattr.c~ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry > +++ a/fs/ocfs2/xattr.c > @@ -1062,7 +1062,7 @@ ssize_t ocfs2_listxattr(struct dentry *d > return i_ret + b_ret; > } > > -static int ocfs2_xattr_find_entry(int name_index, > +static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, > const char *name, > struct ocfs2_xattr_search *xs) > { > @@ -1076,6 +1076,10 @@ static int ocfs2_xattr_find_entry(int na > name_len = strlen(name); > entry = xs->here; > for (i = 0; i < le16_to_cpu(xs->header->xh_count); i++) { > + if ((void *)entry >= xs->end) { > + ocfs2_error(inode->i_sb, "corrupted xattr entries"); > + return -EFSCORRUPTED; > + } > cmp = name_index - ocfs2_xattr_get_type(entry); > if (!cmp) > cmp = name_len - entry->xe_name_len; > @@ -1166,7 +1170,7 @@ static int ocfs2_xattr_ibody_get(struct > xs->base = (void *)xs->header; > xs->here = xs->header->xh_entries; > > - ret = ocfs2_xattr_find_entry(name_index, name, xs); > + ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); > if (ret) > return ret; > size = le64_to_cpu(xs->here->xe_value_size); > @@ -2698,7 +2702,7 @@ static int ocfs2_xattr_ibody_find(struct > > /* Find the named attribute. */ > if (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) { > - ret = ocfs2_xattr_find_entry(name_index, name, xs); > + ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); > if (ret && ret != -ENODATA) > return ret; > xs->not_found = ret; > @@ -2833,7 +2837,7 @@ static int ocfs2_xattr_block_find(struct > xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; > xs->here = xs->header->xh_entries; > > - ret = ocfs2_xattr_find_entry(name_index, name, xs); > + ret = ocfs2_xattr_find_entry(inode, name_index, name, xs); > } else > ret = ocfs2_xattr_index_block_find(inode, blk_bh, > name_index, > _ > > Patches currently in -mm which might be from mengferry@xxxxxxxxxxxxxxxxx are > > ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch > ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch
