| Message ID | 20180701212051.29486-2-richard@nod.at |
|---|---|
| State | Accepted |
| Delegated to: | Richard Weinberger |
| Headers | show |
| Series | [1/2] Revert "UBIFS: Fix potential integer overflow in allocation" | expand |
On Sun, Jul 1, 2018 at 2:20 PM, Richard Weinberger <richard@nod.at> wrote: > Check whether the size is within bounds before using it. > If the size is not correct, abort and dump the bad data node. > > Cc: Kees Cook <keescook@chromium.org> > Cc: Silvio Cesare <silvio.cesare@gmail.com> > Cc: stable@vger.kernel.org > Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") > Reported-by: Silvio Cesare <silvio.cesare@gmail.com> > Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Kees Cook <keescook@chromium.org> -Kees > --- > fs/ubifs/journal.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c > index da8afdfccaa6..eea12d25a58b 100644 > --- a/fs/ubifs/journal.c > +++ b/fs/ubifs/journal.c > @@ -1387,7 +1387,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, > else if (err) > goto out_free; > else { > - if (le32_to_cpu(dn->size) <= dlen) > + int dn_len = le32_to_cpu(dn->size); > + > + if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { > + ubifs_err(c, "bad data node (block %u, inode %lu)", > + blk, inode->i_ino); > + ubifs_dump_node(c, dn); > + goto out_free; > + } > + > + if (dn_len <= dlen) > dlen = 0; /* Nothing to do */ > else { > err = truncate_data_node(c, inode, blk, dn, &dlen); > -- > 2.18.0 >
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c index da8afdfccaa6..eea12d25a58b 100644 --- a/fs/ubifs/journal.c +++ b/fs/ubifs/journal.c @@ -1387,7 +1387,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, else if (err) goto out_free; else { - if (le32_to_cpu(dn->size) <= dlen) + int dn_len = le32_to_cpu(dn->size); + + if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { + ubifs_err(c, "bad data node (block %u, inode %lu)", + blk, inode->i_ino); + ubifs_dump_node(c, dn); + goto out_free; + } + + if (dn_len <= dlen) dlen = 0; /* Nothing to do */ else { err = truncate_data_node(c, inode, blk, dn, &dlen);
Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data node. Cc: Kees Cook <keescook@chromium.org> Cc: Silvio Cesare <silvio.cesare@gmail.com> Cc: stable@vger.kernel.org Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") Reported-by: Silvio Cesare <silvio.cesare@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at> --- fs/ubifs/journal.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)