From: Christoph Hellwig <hch@infradead.org>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: xfs <linux-xfs@vger.kernel.org>
Subject: Re: [PATCH] xfs: fix memory exposure problems
Date: Sat, 1 Apr 2017 00:04:06 -0700 [thread overview]
Message-ID: <20170401070406.GA6051@infradead.org> (raw)
In-Reply-To: <20170401012934.GI4864@birch.djwong.org>
On Fri, Mar 31, 2017 at 06:29:34PM -0700, Darrick J. Wong wrote:
> Fix a couple of memory exposure problems in the getbmap implementation
> where we copy too much header data from userspace, and a second problem
> in inumbers where we allocate an array of structures with holes, fail to
> zero the holes, then blindly copy the kernel memory contents into
> userspace.
This should be two different patches.
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -1547,10 +1547,10 @@ xfs_ioc_getbmap(
> unsigned int cmd,
> void __user *arg)
> {
> - struct getbmapx bmx;
> + struct getbmapx bmx = {0};
missing spaces around the zero.
> int error;
>
> - if (copy_from_user(&bmx, arg, sizeof(struct getbmapx)))
> + if (copy_from_user(&bmx, arg, sizeof(struct getbmap)))
> return -EFAULT;
This really needs a comment on how struct getbmap is a strict subset
of struct getbmapx. Or even better don't use getbmap at all
and use offsetoff on struct getbmapx.
> diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
> index e775f78..55642cd 100644
> --- a/fs/xfs/xfs_itable.c
> +++ b/fs/xfs/xfs_itable.c
> @@ -584,7 +584,7 @@ xfs_inumbers(
> return error;
>
> bcount = MIN(left, (int)(PAGE_SIZE / sizeof(*buffer)));
> - buffer = kmem_alloc(bcount * sizeof(*buffer), KM_SLEEP);
> + buffer = kmem_zalloc(bcount * sizeof(*buffer), KM_SLEEP);
This looks fine:
Reviewed-by: Christoph Hellwig <hch@lst.de>
next prev parent reply other threads:[~2017-04-01 7:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-01 1:29 [PATCH] xfs: fix memory exposure problems Darrick J. Wong
2017-04-01 7:04 ` Christoph Hellwig [this message]
2017-04-01 18:14 ` Eric Sandeen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170401070406.GA6051@infradead.org \
--to=hch@infradead.org \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.