Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff Mahoney <jeffm@suse.com>2016-06-07 10:02:59 -0400
committerJeff Mahoney <jeffm@suse.com>2016-06-07 10:08:35 -0400
commitc63531c60ffb4ac8d1929153cf9b8fcc205aa979 (patch)
tree3896f95374bcdf5def2857b8b19d5c8af1dce08f
parentdfd4e556b6eabb08448dd5297eaa7acd4308b029 (diff)
get_rock_ridge_filename(): handle malformed NM entries
(bsc#980725 CVE-2016-4913).
-rw-r--r--patches.fixes/isofs-get_rock_ridge_filename-handle-malformed-nm-entries64
-rw-r--r--series.conf1
2 files changed, 65 insertions, 0 deletions
diff --git a/patches.fixes/isofs-get_rock_ridge_filename-handle-malformed-nm-entries b/patches.fixes/isofs-get_rock_ridge_filename-handle-malformed-nm-entries
new file mode 100644
index 0000000000..9f108e34aa
--- /dev/null
+++ b/patches.fixes/isofs-get_rock_ridge_filename-handle-malformed-nm-entries
@@ -0,0 +1,64 @@
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 5 May 2016 16:25:35 -0400
+Subject: get_rock_ridge_filename(): handle malformed NM entries
+Git-commit: 99d825822eade8d827a1817357cbf3f889a552d6
+Patch-mainline: v4.6
+References: bsc#980725 CVE-2016-4913
+
+Payloads of NM entries are not supposed to contain NUL. When we run
+into such, only the part prior to the first NUL goes into the
+concatenation (i.e. the directory entry name being encoded by a bunch
+of NM entries). We do stop when the amount collected so far + the
+claimed amount in the current NM entry exceed 254. So far, so good,
+but what we return as the total length is the sum of *claimed*
+sizes, not the actual amount collected. And that can grow pretty
+large - not unlimited, since you'd need to put CE entries in
+between to be able to get more than the maximum that could be
+contained in one isofs directory entry / continuation chunk and
+we are stop once we'd encountered 32 CEs, but you can get about 8Kb
+easily. And that's what will be passed to readdir callback as the
+name length. 8Kb __copy_to_user() from a buffer allocated by
+__get_free_page()
+
+Cc: stable@vger.kernel.org # 0.98pl6+ (yes, really)
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Jeff Mahoney <jeffm@suse.com>
+---
+ fs/isofs/rock.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index 5384ceb..98b3eb7 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de,
+ int retnamlen = 0;
+ int truncate = 0;
+ int ret = 0;
++ char *p;
++ int len;
+
+ if (!ISOFS_SB(inode->i_sb)->s_rock)
+ return 0;
+@@ -267,12 +269,17 @@ repeat:
+ rr->u.NM.flags);
+ break;
+ }
+- if ((strlen(retname) + rr->len - 5) >= 254) {
++ len = rr->len - 5;
++ if (retnamlen + len >= 254) {
+ truncate = 1;
+ break;
+ }
+- strncat(retname, rr->u.NM.name, rr->len - 5);
+- retnamlen += rr->len - 5;
++ p = memchr(rr->u.NM.name, '\0', len);
++ if (unlikely(p))
++ len = p - rr->u.NM.name;
++ memcpy(retname + retnamlen, rr->u.NM.name, len);
++ retnamlen += len;
++ retname[retnamlen] = '\0';
+ break;
+ case SIG('R', 'E'):
+ kfree(rs.buffer);
+
diff --git a/series.conf b/series.conf
index 1421ae897a..ac46448dcb 100644
--- a/series.conf
+++ b/series.conf
@@ -2226,6 +2226,7 @@
patches.fixes/nfs-lock-recovery.fix
patches.fixes/SUNRPC-Fix-a-data-corruption-issue-when-retransmitti.patch
patches.fixes/vfs-fix-race-between-fcntl-and-file-f_flags-checks.patch
+ patches.fixes/isofs-get_rock_ridge_filename-handle-malformed-nm-entries
########################################################
# Lustre enablement