Messages in this thread Patch in this message | | | From | Linus Torvalds <> | Date | Sat, 17 Apr 2021 09:27:04 -0700 | Subject | Re: [PATCH] x86/uaccess: small optimization in unsafe_copy_to_user() |
| |
On Sat, Apr 17, 2021 at 9:08 AM Linus Torvalds <torvalds@linux-foundation.org> wrote: > > Side note: I'm, looking at the readdir cases that I wrote, and I have > to just say that is broken too. So "stones and glass houses" etc, and > I'll have to fix that too.
In particular, the very very old OLD_READDIR interface that only fills in one dirent at a time didn't call verify_dirent_name(). Same for the compat version.
This requires a corrupt filesystem to be an issue (and even then, most/all would have the length of a directory entry in an 'unsigned char', so even corrupt filesystems would generally never have a negative name length).
So I don't think it's an issue in _practice_, but at the same time it is very much an example of the same issue that put_cmsg() has in net-next: unsafe user copies should be fully guarded and not have some "but this would never happen because callers would never do anything bad".
Al - fairly trivial patch applied, comments?
Linus fs/readdir.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/fs/readdir.c b/fs/readdir.c index 19434b3c982c..09e8ed7d4161 100644 --- a/fs/readdir.c +++ b/fs/readdir.c @@ -150,6 +150,9 @@ static int fillonedir(struct dir_context *ctx, const char *name, int namlen, if (buf->result) return -EINVAL; + buf->result = verify_dirent_name(name, namlen); + if (buf->result < 0) + return buf->result; d_ino = ino; if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { buf->result = -EOVERFLOW; @@ -405,6 +408,9 @@ static int compat_fillonedir(struct dir_context *ctx, const char *name, if (buf->result) return -EINVAL; + buf->result = verify_dirent_name(name, namlen); + if (buf->result < 0) + return buf->result; d_ino = ino; if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) { buf->result = -EOVERFLOW; | |