Messages in this thread | | | Date | Wed, 3 Jan 2007 16:26:43 -0800 | From | Andrew Morton <> | Subject | Re: [UPDATED PATCH] fix memory corruption from misinterpreted bad_inode_ops return values |
| |
On Wed, 03 Jan 2007 17:46:00 -0600 Eric Sandeen <sandeen@redhat.com> wrote:
> Take 2... all in one file. I suppose I really did know better than > to create that new header. ;-) > > Better? > > --- > > CVE-2006-5753 is for a case where an inode can be marked bad, switching > the ops to bad_inode_ops, which are all connected as: > > static int return_EIO(void) > { > return -EIO; > } > > #define EIO_ERROR ((void *) (return_EIO)) > > static struct inode_operations bad_inode_ops = > { > .create = bad_inode_create > ...etc... > > The problem here is that the void cast causes return types to not be > promoted, and for ops such as listxattr which expect more than 32 bits of > return value, the 32-bit -EIO is interpreted as a large positive 64-bit > number, i.e. 0x00000000fffffffa instead of 0xfffffffa. > > This goes particularly badly when the return value is taken as a number of > bytes to copy into, say, a user's buffer for example... > > I originally had coded up the fix by creating a return_EIO_<TYPE> macro > for each return type, like this: > > static int return_EIO_int(void) > { > return -EIO; > } > #define EIO_ERROR_INT ((void *) (return_EIO_int)) > > static struct inode_operations bad_inode_ops = > { > .create = EIO_ERROR_INT, > ...etc... > > but Al felt that it was probably better to create an EIO-returner for each > actual op signature. Since so few ops share a signature, I just went ahead > & created an EIO function for each individual file & inode op that returns > a value. >
Al is correct, of course. But the patch takes bad_inode.o from 280 up to 703 bytes, which is a bit sad for some cosmetic thing which nobody ever looks at or modifies.
Perhaps you can do
static int return_EIO_int(void) { return -EIO; }
static int bad_file_release(struct inode * inode, struct file * filp) __attribute__((alias("return_EIO_int"))); static int bad_file_fsync(struct inode * inode, struct file * filp) __attribute__((alias("return_EIO_int")));
etcetera? - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |