lkml.org 
[lkml]   [2020]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.8 074/186] xfs: fix boundary test in xfs_attr_shortform_verify
    Date
    From: Eric Sandeen <sandeen@redhat.com>

    [ Upstream commit f4020438fab05364018c91f7e02ebdd192085933 ]

    The boundary test for the fixed-offset parts of xfs_attr_sf_entry in
    xfs_attr_shortform_verify is off by one, because the variable array
    at the end is defined as nameval[1] not nameval[].
    Hence we need to subtract 1 from the calculation.

    This can be shown by:

    # touch file
    # setfattr -n root.a file

    and verifications will fail when it's written to disk.

    This only matters for a last attribute which has a single-byte name
    and no value, otherwise the combination of namelen & valuelen will
    push endp further out and this test won't fail.

    Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs")
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
    index 2f7e89e4be3e3..4eb2ecd31b0d2 100644
    --- a/fs/xfs/libxfs/xfs_attr_leaf.c
    +++ b/fs/xfs/libxfs/xfs_attr_leaf.c
    @@ -996,8 +996,10 @@ xfs_attr_shortform_verify(
    * struct xfs_attr_sf_entry has a variable length.
    * Check the fixed-offset parts of the structure are
    * within the data buffer.
    + * xfs_attr_sf_entry is defined with a 1-byte variable
    + * array at the end, so we must subtract that off.
    */
    - if (((char *)sfep + sizeof(*sfep)) >= endp)
    + if (((char *)sfep + sizeof(*sfep) - 1) >= endp)
    return __this_address;

    /* Don't allow names with known bad length. */
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-09-08 21:33    [W:2.840 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site