From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: xfs <linux-xfs@vger.kernel.org>
Subject: [RFC PATCH] xfs: don't run off the end of the buffer reading inline dirents
Date: Wed, 8 Mar 2017 13:01:12 -0800 [thread overview]
Message-ID: <20170308210112.GR5280@birch.djwong.org> (raw)
Check that we don't run off the end of the inline data buffer when we're
trying to read directory entries. xfs/348 triggered kernel memory being
exposed to userspace and a related complaint from the usercopy code.
Evidently once we call dir_emit, the VFS ignores error return values
since it's already begun copying data back to userspace.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
fs/xfs/xfs_dir2_readdir.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 003a99b..70bdd21 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -69,6 +69,7 @@ xfs_dir2_sf_getdents(
xfs_dir2_dataptr_t dotdot_offset;
xfs_ino_t ino;
struct xfs_da_geometry *geo = args->geo;
+ char *endp;
ASSERT(dp->i_df.if_flags & XFS_IFINLINE);
/*
@@ -83,6 +84,7 @@ xfs_dir2_sf_getdents(
ASSERT(dp->i_df.if_u1.if_data != NULL);
sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
+ endp = dp->i_df.if_u1.if_data + dp->i_df.if_bytes;
if (dp->i_d.di_size < xfs_dir2_sf_hdr_size(sfp->i8count))
return -EFSCORRUPTED;
@@ -130,6 +132,12 @@ xfs_dir2_sf_getdents(
for (i = 0; i < sfp->count; i++) {
__uint8_t filetype;
+ /* If we pass the end of the buffer, we're done. */
+ if (((char *)sfep + sizeof(*sfep)) >= endp ||
+ (char *)dp->d_ops->sf_nextentry(sfp, sfep) > endp) {
+ break;
+ }
+
off = xfs_dir2_db_off_to_dataptr(geo, geo->datablk,
xfs_dir2_sf_get_offset(sfep));
next reply other threads:[~2017-03-08 21:01 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-08 21:01 Darrick J. Wong [this message]
2017-03-13 12:39 ` [RFC PATCH] xfs: don't run off the end of the buffer reading inline dirents Brian Foster
2017-03-13 20:55 ` Darrick J. Wong
2017-03-14 11:33 ` Brian Foster
2017-03-14 18:37 ` Darrick J. Wong
2017-03-14 20:24 ` Brian Foster
2017-03-14 23:55 ` Darrick J. Wong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170308210112.GR5280@birch.djwong.org \
--to=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.