From: Ferry Meng <mengferry@linux.alibaba.com>
To: Mark Fasheh <mark@fasheh.com>, Joel Becker <jlbec@evilplan.org>,
Joseph Qi <joseph.qi@linux.alibaba.com>,
ocfs2-devel@lists.linux.dev
Cc: linux-kernel@vger.kernel.org, Ferry Meng <mengferry@linux.alibaba.com>
Subject: [PATCH v2 0/2] ocfs2: add checks in ocfs2_xattr_find_entry() to avoid potential out-of-bound access.
Date: Fri, 17 May 2024 17:41:45 +0800 [thread overview]
Message-ID: <20240517094147.87133-1-mengferry@linux.alibaba.com> (raw)
Hi, all:
This patch series attempts to address a scenario where accessing user-defined
xattrs in a carefully crafted image can lead to out-of-bound access.(To speak
truthfully, I do not think this vehavior would occur under proper usage.)
In my testing environment, I constructed an OCFS2 image, created a file with
several user-defined xattrs(long name attributes, this will cause a "Non-INLINE"
xattr, which requires additional space for storage), and then forcibly modified
the xe_name_offset using a binary editing tool (e.g "hexedit"). Upon remounting
the image and running 'getfattr -d /path/to/file', this patchset was able to
detect "partial" malicious modification.
In v2, I make these changes:
- (1/2) use xs->end directly, no need to parse a parameter.
- (2/2) define a local var 'name_offset'.
Ferry Meng (2):
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
fs/ocfs2/xattr.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
--
2.32.0.3.g01195cf9f
next reply other threads:[~2024-05-17 9:42 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-17 9:41 Ferry Meng [this message]
2024-05-17 9:41 ` [PATCH v2 1/2] ocfs2: add bounds checking to ocfs2_xattr_find_entry() Ferry Meng
2024-05-17 10:52 ` Joseph Qi
2024-05-17 9:41 ` [PATCH v2 2/2] ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() Ferry Meng
2024-05-17 10:53 ` Joseph Qi
2024-05-28 11:30 ` lei lu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240517094147.87133-1-mengferry@linux.alibaba.com \
--to=mengferry@linux.alibaba.com \
--cc=jlbec@evilplan.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark@fasheh.com \
--cc=ocfs2-devel@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).