lkml.org 
[lkml]   [2022]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 6.1 03/22] jfs: Fix fortify moan in symlink
    Date
    From: "Dr. David Alan Gilbert" <linux@treblig.org>

    [ Upstream commit ebe060369f8d6e4588b115f252bebf5ba4d64350 ]

    JFS has in jfs_incore.h:

    /* _inline may overflow into _inline_ea when needed */
    /* _inline_ea may overlay the last part of
    * file._xtroot if maxentry = XTROOTINITSLOT
    */
    union {
    struct {
    /* 128: inline symlink */
    unchar _inline[128];
    /* 128: inline extended attr */
    unchar _inline_ea[128];
    };
    unchar _inline_all[256];

    and currently the symlink code copies into _inline;
    if this is larger than 128 bytes it triggers a fortify warning of the
    form:

    memcpy: detected field-spanning write (size 132) of single field
    "ip->i_link" at fs/jfs/namei.c:950 (size 18446744073709551615)

    when it's actually OK.

    Copy it into _inline_all instead.

    Reported-by: syzbot+5fc38b2ddbbca7f5c680@syzkaller.appspotmail.com
    Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/jfs/namei.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
    index 9db4f5789c0e..4fbbf88435e6 100644
    --- a/fs/jfs/namei.c
    +++ b/fs/jfs/namei.c
    @@ -946,7 +946,7 @@ static int jfs_symlink(struct user_namespace *mnt_userns, struct inode *dip,
    if (ssize <= IDATASIZE) {
    ip->i_op = &jfs_fast_symlink_inode_operations;

    - ip->i_link = JFS_IP(ip)->i_inline;
    + ip->i_link = JFS_IP(ip)->i_inline_all;
    memcpy(ip->i_link, name, ssize);
    ip->i_size = ssize - 1;

    --
    2.35.1
    \
     
     \ /
      Last update: 2022-12-17 16:28    [W:3.950 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site