From patchwork Wed Apr 25 18:45:22 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xi Wang X-Patchwork-Id: 155057 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:4978:20e::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 64828B6FD1 for ; Thu, 26 Apr 2012 04:46:53 +1000 (EST) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1SN7Dk-000399-95; Wed, 25 Apr 2012 18:45:44 +0000 Received: from mail-qc0-f177.google.com ([209.85.216.177]) by merlin.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1SN7Dh-00038i-Dr for linux-mtd@lists.infradead.org; Wed, 25 Apr 2012 18:45:41 +0000 Received: by qcsu28 with SMTP id u28so314153qcs.36 for ; Wed, 25 Apr 2012 11:45:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer; bh=Lj6J098J7d7VGsG+DCEPMH8Br7xdmAPB1WcGSDqrCIU=; b=dOkZvwunuVnafLaRaKVjX6Pr0l/iP/73A3HUACOXedstIGwM5Ly3B9kl6i+IUjhTcz JlsVwvt75FdnnmJXG6hTze8yH47LQtD1PIE5RwZhC1pW/mVx+Zbn1N/yeMV8FdPgm5xG VXouWsGsP2PwXhMZ+klmascnnl4QQxnoxrTHjpIbfJfuYsJkEwWPuCwjD2ZXBgVRCDiC zJJb+gMag4AOrxgsiP3HtB13qEd5rfgIL2U0hs1OtckfIBX/DQ3e8Abfl7SdqWajkQgm bEPQMjJ3Yya6th7RT6ingAd6vFSGlYA0/h/5Ls5VVp968gUThP8Ba+Oq7NGPDKfdbTSE 4vPA== Received: by 10.224.193.8 with SMTP id ds8mr3222995qab.1.1335379539123; Wed, 25 Apr 2012 11:45:39 -0700 (PDT) Received: from localhost.localdomain (hchen.csail.mit.edu. [18.26.5.5]) by mx.google.com with ESMTPS id q11sm1569736qap.18.2012.04.25.11.45.36 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 25 Apr 2012 11:45:37 -0700 (PDT) From: Xi Wang To: David Woodhouse Subject: [PATCH v2 1/2] jffs2: validate symlink size in jffs2_do_read_inode_internal() Date: Wed, 25 Apr 2012 14:45:22 -0400 Message-Id: <1335379523-31415-1-git-send-email-xi.wang@gmail.com> X-Mailer: git-send-email 1.7.5.4 X-Spam-Note: CRM114 invocation failed X-Spam-Score: -2.7 (--) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-2.7 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (xi.wang[at]gmail.com) -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.216.177 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: linux-mtd@lists.infradead.org, Xi Wang , Artem Bityutskiy X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org `csize' is read from disk and thus needs validation. Otherwise a bogus value 0xffffffff would turn the subsequent kmalloc(csize + 1, ...) into kmalloc(0, ...), leading to out-of-bounds write. This patch limits `csize' to JFFS2_MAX_NAME_LEN, which is also used in jffs2_symlink(). Signed-off-by: Xi Wang Cc: Artem Bityutskiy --- fs/jffs2/readinode.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c index dc0437e..9897f38 100644 --- a/fs/jffs2/readinode.c +++ b/fs/jffs2/readinode.c @@ -1266,6 +1266,12 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c, /* Symlink's inode data is the target path. Read it and * keep in RAM to facilitate quick follow symlink * operation. */ + uint32_t csize = je32_to_cpu(latest_node->csize); + if (csize > JFFS2_MAX_NAME_LEN) { + mutex_unlock(&f->sem); + jffs2_do_clear_inode(c, f); + return -ENAMETOOLONG; + } f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL); if (!f->target) { JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));