| Message ID | 20180731033030.30004-1-tytso@mit.edu |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | ext4: check for NUL characters in extended attribute's name | expand |
On Mon, Jul 30, 2018 at 11:30:30PM -0400, Theodore Ts'o wrote: > Extended attribute names are defined to be NUL-terminated, so the name > must not contain a NUL character. This is important because there are > places when remove extended attribute, the code uses strlen to > determine the length of the entry. That should probably be fixed at > some point, but code is currently really messy, so the simplest fix > for now is to simply validate that the extended attributes are sane. > > https://bugzilla.kernel.org/show_bug.cgi?id=200623 Oops, sorry, wrong bug. That should have read: https://bugzilla.kernel.org/show_bug.cgi?id=200401 I'll fix this in my tree. - Ted
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 723df14f4084..f36fc5d5b257 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -190,6 +190,8 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end, struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); if ((void *)next >= end) return -EFSCORRUPTED; + if (strnlen(e->e_name, e->e_name_len) != e->e_name_len) + return -EFSCORRUPTED; e = next; }
Extended attribute names are defined to be NUL-terminated, so the name must not contain a NUL character. This is important because there are places when remove extended attribute, the code uses strlen to determine the length of the entry. That should probably be fixed at some point, but code is currently really messy, so the simplest fix for now is to simply validate that the extended attributes are sane. https://bugzilla.kernel.org/show_bug.cgi?id=200623 Reported-by: Wen Xu <wen.xu@gatech.edu> Signed-off-by: Theodore Ts'o <tytso@mit.edu> --- fs/ext4/xattr.c | 2 ++ 1 file changed, 2 insertions(+)