kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/btrfs
History
Nikolay Borisov 12878d0293 btrfs: Fix possible off-by-one in btrfs_search_path_in_tree 
commit c8bcbfbd23 upstream.

The name char array passed to btrfs_search_path_in_tree is of size
BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes
are in the range of [0, 4079]. Currently the code uses the define but this
represents an off-by-one.

Implications:

Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be
written to extra space, not some padding that could be provided by the
allocator.

btrfs-progs store the arguments on stack, but kernel does own copy of
the ioctl buffer and the off-by-one overwrite does not affect userspace,
but the ending 0 might be lost.

Kernel ioctl buffer is allocated dynamically so we're overwriting
somebody else's memory, and the ioctl is privileged if args.objectid is
not 256. Which is in most cases, but resolving a subvolume stored in
another directory will trigger that path.

Before this patch the buffer was one byte larger, but then the -1 was
not added.

Fixes: ac8e9819d7 ("Btrfs: add search and inode lookup ioctls")
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ added implications ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-03-03 15:51:47 +00:00
..
tests Btrfs: fix qgroups sanity test crash or hang 2014-06-13 09:52:24 -07:00
acl.c btrfs: preserve i_mode if __btrfs_set_acl() fails 2017-10-12 15:28:09 +01:00
async-thread.c btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
async-thread.h btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
backref.c Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl 2016-02-25 10:34:37 +00:00
backref.h Btrfs: fix scrub_print_warning to handle skinny metadata extents 2014-06-09 17:21:17 -07:00
btrfs_inode.h btrfs: disable strict file flushes for renames and truncates 2014-09-05 16:36:37 -07:00
check-integrity.c btrfs: check_int: propagate out-of-memory error upwards 2014-06-09 17:20:21 -07:00
check-integrity.h block: submit_bio_wait() conversions 2013-11-24 16:33:41 -07:00
compression.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
compression.h btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
ctree.c Btrfs: make xattr replace operations atomic 2015-03-30 11:11:47 +01:00
ctree.h btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl 2016-08-22 22:37:52 +01:00
delayed-inode.c btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
delayed-inode.h btrfs: properly set the termination value of ctx->pos in readdir 2016-02-25 10:34:58 +00:00
delayed-ref.c Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
delayed-ref.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
dev-replace.c btrfs: Fix a deadlock in btrfs_dev_replace_finishing() 2014-10-30 09:40:08 -07:00
dev-replace.h Btrfs: add new sources for device replace code 2012-12-12 17:15:41 -05:00
dir-item.c Btrfs: make xattr replace operations atomic 2015-03-30 11:11:47 +01:00
disk-io.c Btrfs: disable FUA if mounted with nobarrier 2018-03-03 15:51:46 +00:00
disk-io.h Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
export.c btrfs: remove fs/btrfs/compat.h 2013-11-11 22:03:19 -05:00
export.h NFS support for btrfs - v3 2008-09-25 11:04:06 -04:00
extent-tree.c btrfs: fix missing error return in btrfs_drop_snapshot 2018-03-03 15:51:46 +00:00
extent_io.c btrfs: fix incorrect error return ret being passed to mapping_set_error 2017-09-15 18:29:39 +01:00
extent_io.h Btrfs: remove unused wait queue in struct extent_buffer 2014-06-19 14:20:28 -07:00
extent_map.c Btrfs: do not move em to modified list when unpinning 2015-01-05 13:48:52 +00:00
extent_map.h Btrfs: fix NULL pointer crash when running balance and scrub concurrently 2014-06-19 14:20:55 -07:00
file-item.c Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup 2014-11-14 15:19:58 +00:00
file.c Btrfs: fix invalid extent maps due to hole punching 2017-10-12 15:27:51 +01:00
free-space-cache.c Btrfs: fix broken free space cache after the system crashed 2014-06-19 14:20:54 -07:00
free-space-cache.h Btrfs: remove path arg from btrfs_truncate_free_space_cache 2013-11-11 21:51:33 -05:00
hash.c Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
hash.h Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
inode-item.c btrfs: cleanup: removed unused 'btrfs_get_inode_ref_index' 2014-01-28 13:19:39 -08:00
inode-map.c Btrfs: fix race between caching kthread and returning inode to inode cache 2015-07-20 14:38:51 +01:00
inode-map.h Btrfs: Support reading/writing on disk free ino cache 2011-04-25 16:46:11 +08:00
inode.c btrfs: use correct types for page indices in btrfs_page_exists_in_range 2017-09-15 18:29:53 +01:00
ioctl.c btrfs: Fix possible off-by-one in btrfs_search_path_in_tree 2018-03-03 15:51:47 +00:00
Kconfig Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
locking.c btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
locking.h btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
lzo.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
Makefile Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
math.h Btrfs: cleanup duplicated division functions 2012-12-11 13:31:30 -05:00
ordered-data.c Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
ordered-data.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
orphan.c btrfs: expand btrfs_find_item() to include find_orphan_item functionality 2014-01-28 13:19:37 -08:00
print-tree.c Btrfs: fix btrfs_print_leaf for skinny metadata 2014-07-03 07:04:16 -07:00
print-tree.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
props.c Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
props.h Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
qgroup.c btrfs: don't go readonly on existing qgroup items 2015-01-05 10:21:14 +00:00
qgroup.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
raid56.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
raid56.h Btrfs: RAID5 and RAID6 2013-02-01 14:24:23 -05:00
rcu-string.h Btrfs: use rcu to protect device->name 2012-06-14 21:29:16 -04:00
reada.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
relocation.c Btrfs: fix build_backref_tree issue with multiple shared blocks 2014-10-30 09:40:09 -07:00
root-tree.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
scrub.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
send.c Btrfs: send, don't leave without decrementing clone root's send_progress 2015-06-17 15:26:38 +01:00
send.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
struct-funcs.c Btrfs: rewrite BTRFS_SETGET_FUNCS 2012-07-23 16:28:06 -04:00
super.c btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit 2018-02-13 18:42:11 +00:00
sysfs.c btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
sysfs.h btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
transaction.c Btrfs: check if previous transaction aborted to avoid fs corruption 2015-09-28 10:21:46 +01:00
transaction.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
tree-defrag.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
tree-log.c Btrfs: fix tree search logic when replaying directory entry deletes 2017-03-16 02:26:27 +00:00
tree-log.h Btrfs: use helpers for last_trans_log_full_commit instead of opencode 2014-06-09 17:20:45 -07:00
ulist.c Btrfs: do not export ulist functions 2014-01-29 07:06:27 -08:00
ulist.h Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch 2014-09-05 16:36:36 -07:00
uuid-tree.c Btrfs: convert printk to btrfs_ and fix BTRFS prefix 2014-01-28 13:20:05 -08:00
volumes.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
volumes.h btrfs: check unsupported filters in balance arguments 2015-11-16 11:26:49 +00:00
xattr.c Btrfs: fix race when listing an inode's xattrs 2015-12-13 17:49:18 +00:00
xattr.h btrfs: use generic posix ACL infrastructure 2014-01-25 23:58:18 -05:00
zlib.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00