From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Stian Skjelstad <stian.skjelstad@gmail.com>,
Jan Kara <jack@suse.cz>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.19 23/23] udf_get_extendedattr() had no boundary checks.
Date: Sun, 5 Sep 2021 21:23:22 -0400 [thread overview]
Message-ID: <20210906012322.930668-23-sashal@kernel.org> (raw)
In-Reply-To: <20210906012322.930668-1-sashal@kernel.org>
From: Stian Skjelstad <stian.skjelstad@gmail.com>
[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.
Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/misc.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 401e64cde1be..853bcff51043 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
else
offset = le32_to_cpu(eahd->appAttrLocation);
- while (offset < iinfo->i_lenEAttr) {
+ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
+ uint32_t attrLength;
+
gaf = (struct genericFormat *)&ea[offset];
+ attrLength = le32_to_cpu(gaf->attrLength);
+
+ /* Detect undersized elements and buffer overflows */
+ if ((attrLength < sizeof(*gaf)) ||
+ (attrLength > (iinfo->i_lenEAttr - offset)))
+ break;
+
if (le32_to_cpu(gaf->attrType) == type &&
gaf->attrSubtype == subtype)
return gaf;
else
- offset += le32_to_cpu(gaf->attrLength);
+ offset += attrLength;
}
}
--
2.30.2
prev parent reply other threads:[~2021-09-06 1:36 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 1:23 [PATCH AUTOSEL 4.19 01/23] locking/mutex: Fix HANDOFF condition Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 02/23] regmap: fix the offset of register error log Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 03/23] crypto: mxs-dcp - Check for DMA mapping errors Sasha Levin
2021-09-06 1:23 ` Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 04/23] sched/deadline: Fix reset_on_fork reporting of DL tasks Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 05/23] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 06/23] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 07/23] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 08/23] posix-cpu-timers: Force next expiration recalc after itimer reset Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 09/23] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 10/23] udf: Check LVID earlier Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 11/23] isofs: joliet: Fix iocharset=utf8 mount option Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 12/23] bcache: add proper error unwinding in bcache_device_init Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 13/23] nvme-rdma: don't update queue count when failing to set io queues Sasha Levin
2021-09-06 1:23 ` Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 14/23] power: supply: max17042_battery: fix typo in MAx17042_TOFF Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 15/23] s390/cio: add dev_busid sysfs entry for each subchannel Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 16/23] libata: fix ata_host_start() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 17/23] crypto: qat - do not ignore errors from enable_vf2pf_comms() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 18/23] crypto: qat - handle both source of interrupt in VF ISR Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 19/23] crypto: qat - fix reuse of completion variable Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 20/23] crypto: qat - fix naming for init/shutdown VF to PF notifications Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 21/23] crypto: qat - do not export adf_iov_putmsg() Sasha Levin
2021-09-06 1:23 ` [PATCH AUTOSEL 4.19 22/23] fcntl: fix potential deadlock for &fasync_struct.fa_lock Sasha Levin
2021-09-06 1:23 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906012322.930668-23-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stian.skjelstad@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.