From: Carlos Maiolino <cmaiolino@redhat.com>
To: linux-fsdevel@vger.kernel.org
Cc: hch@lst.de, viro@zeniv.linux.org.uk
Subject: [PATCH 5/5] fibmap: Reject negative block numbers
Date: Thu, 9 Jan 2020 14:30:45 +0100 [thread overview]
Message-ID: <20200109133045.382356-6-cmaiolino@redhat.com> (raw)
In-Reply-To: <20200109133045.382356-1-cmaiolino@redhat.com>
FIBMAP receives an integer from userspace which is then implicitly converted
into sector_t to be passed to bmap(). No check is made to ensure userspace
didn't send a negative block number, which can end up in an underflow, and
returning to userspace a corrupted block address.
As a side-effect, the underflow caused by a negative block here, will
trigger the WARN() in iomap_bmap_actor(), which is how this issue was
first discovered.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
---
fs/ioctl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 0ed5fb2d6c19..72d6848fb6ad 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -65,6 +65,9 @@ static int ioctl_fibmap(struct file *filp, int __user *p)
if (error)
return error;
+ if (ur_block < 0)
+ return -EINVAL;
+
block = ur_block;
error = bmap(inode, &block);
--
2.23.0
next prev parent reply other threads:[~2020-01-09 13:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-09 13:30 [PATCH V8 0/5] Refactor ioctl_fibmap() internal interface Carlos Maiolino
2020-01-09 13:30 ` [PATCH 1/5] fs: Enable bmap() function to properly return errors Carlos Maiolino
2020-01-09 13:30 ` [PATCH 2/5] cachefiles: drop direct usage of ->bmap method Carlos Maiolino
2020-04-09 0:32 ` NeilBrown
2020-04-16 14:03 ` David Wysochanski
2020-01-09 13:30 ` [PATCH 3/5] ecryptfs: drop direct calls to ->bmap Carlos Maiolino
2020-01-09 13:30 ` [PATCH 4/5] fibmap: Use bmap instead of ->bmap method in ioctl_fibmap Carlos Maiolino
2020-01-09 13:30 ` Carlos Maiolino [this message]
2020-01-09 15:05 ` [PATCH V8 0/5] Refactor ioctl_fibmap() internal interface Al Viro
-- strict thread matches above, loose matches on Subject: below --
2019-12-10 15:03 [PATCH " Carlos Maiolino
2019-12-10 15:03 ` [PATCH 5/5] fibmap: Reject negative block numbers Carlos Maiolino
2019-11-22 8:53 [PATCH 0/5] Refactor ioctl_fibmap() internal interface Carlos Maiolino
2019-11-22 8:53 ` [PATCH 5/5] fibmap: Reject negative block numbers Carlos Maiolino
2019-11-22 13:38 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200109133045.382356-6-cmaiolino@redhat.com \
--to=cmaiolino@redhat.com \
--cc=hch@lst.de \
--cc=linux-fsdevel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.