| Message ID | 20200601200543.59417-1-ebiggers@kernel.org |
|---|---|
| State | Awaiting Upstream |
| Headers | show |
| Series | [v2] ext4: avoid utf8_strncasecmp() with unstable name | expand |
On Jun 1, 2020, at 2:05 PM, Eric Biggers <ebiggers@kernel.org> wrote: > > From: Eric Biggers <ebiggers@google.com> > > If the dentry name passed to ->d_compare() fits in dentry::d_iname, then > it may be concurrently modified by a rename. This can cause undefined > behavior (possibly out-of-bounds memory accesses or crashes) in > utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings > that may be concurrently modified. > > Fix this by first copying the filename to a stack buffer if needed. > This way we get a stable snapshot of the filename. > > Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups") > Cc: <stable@vger.kernel.org> # v5.2+ > Cc: Al Viro <viro@zeniv.linux.org.uk> > Cc: Daniel Rosenberg <drosen@google.com> > Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk> > Signed-off-by: Eric Biggers <ebiggers@google.com> LGTM. Reviewed-by: Andreas Dilger <adilger@dilger.ca> > --- > > v2: use memcpy() + barrier() instead of a byte-by-byte copy. > > fs/ext4/dir.c | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c > index c654205f648dd..1d82336b1cd45 100644 > --- a/fs/ext4/dir.c > +++ b/fs/ext4/dir.c > @@ -675,6 +675,7 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len, > struct qstr qstr = {.name = str, .len = len }; > const struct dentry *parent = READ_ONCE(dentry->d_parent); > const struct inode *inode = READ_ONCE(parent->d_inode); > + char strbuf[DNAME_INLINE_LEN]; > > if (!inode || !IS_CASEFOLDED(inode) || > !EXT4_SB(inode->i_sb)->s_encoding) { > @@ -683,6 +684,21 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len, > return memcmp(str, name->name, len); > } > > + /* > + * If the dentry name is stored in-line, then it may be concurrently > + * modified by a rename. If this happens, the VFS will eventually retry > + * the lookup, so it doesn't matter what ->d_compare() returns. > + * However, it's unsafe to call utf8_strncasecmp() with an unstable > + * string. Therefore, we have to copy the name into a temporary buffer. > + */ > + if (len <= DNAME_INLINE_LEN - 1) { > + memcpy(strbuf, str, len); > + strbuf[len] = 0; > + qstr.name = strbuf; > + /* prevent compiler from optimizing out the temporary buffer */ > + barrier(); > + } > + > return ext4_ci_compare(inode, name, &qstr, false); > } > > -- > 2.26.2 > Cheers, Andreas
On Mon, Jun 01, 2020 at 01:05:43PM -0700, Eric Biggers wrote: > From: Eric Biggers <ebiggers@google.com> > > If the dentry name passed to ->d_compare() fits in dentry::d_iname, then > it may be concurrently modified by a rename. This can cause undefined > behavior (possibly out-of-bounds memory accesses or crashes) in > utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings > that may be concurrently modified. > > Fix this by first copying the filename to a stack buffer if needed. > This way we get a stable snapshot of the filename. > > Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups") > Cc: <stable@vger.kernel.org> # v5.2+ > Cc: Al Viro <viro@zeniv.linux.org.uk> > Cc: Daniel Rosenberg <drosen@google.com> > Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk> > Signed-off-by: Eric Biggers <ebiggers@google.com> > --- > > v2: use memcpy() + barrier() instead of a byte-by-byte copy. > > fs/ext4/dir.c | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) Ted, could you take this through the ext4 tree as a fix for 5.8? The f2fs patch has been merged already. - Eric
On Mon, Jun 01, 2020 at 02:49:51PM -0600, Andreas Dilger wrote: > On Jun 1, 2020, at 2:05 PM, Eric Biggers <ebiggers@kernel.org> wrote: > > > > From: Eric Biggers <ebiggers@google.com> > > > > If the dentry name passed to ->d_compare() fits in dentry::d_iname, then > > it may be concurrently modified by a rename. This can cause undefined > > behavior (possibly out-of-bounds memory accesses or crashes) in > > utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings > > that may be concurrently modified. > > > > Fix this by first copying the filename to a stack buffer if needed. > > This way we get a stable snapshot of the filename. > > > > Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups") > > Cc: <stable@vger.kernel.org> # v5.2+ > > Cc: Al Viro <viro@zeniv.linux.org.uk> > > Cc: Daniel Rosenberg <drosen@google.com> > > Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk> > > Signed-off-by: Eric Biggers <ebiggers@google.com> > > LGTM. > > Reviewed-by: Andreas Dilger <adilger@dilger.ca> Thanks, applied. - Ted
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index c654205f648dd..1d82336b1cd45 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -675,6 +675,7 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len, struct qstr qstr = {.name = str, .len = len }; const struct dentry *parent = READ_ONCE(dentry->d_parent); const struct inode *inode = READ_ONCE(parent->d_inode); + char strbuf[DNAME_INLINE_LEN]; if (!inode || !IS_CASEFOLDED(inode) || !EXT4_SB(inode->i_sb)->s_encoding) { @@ -683,6 +684,21 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len, return memcmp(str, name->name, len); } + /* + * If the dentry name is stored in-line, then it may be concurrently + * modified by a rename. If this happens, the VFS will eventually retry + * the lookup, so it doesn't matter what ->d_compare() returns. + * However, it's unsafe to call utf8_strncasecmp() with an unstable + * string. Therefore, we have to copy the name into a temporary buffer. + */ + if (len <= DNAME_INLINE_LEN - 1) { + memcpy(strbuf, str, len); + strbuf[len] = 0; + qstr.name = strbuf; + /* prevent compiler from optimizing out the temporary buffer */ + barrier(); + } + return ext4_ci_compare(inode, name, &qstr, false); }