Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1157452

[PATCH 3.14 40/64] jbd2: fix r_count overflows leading to buffer overflow in journal recovery

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.14 40/64] jbd2: fix r_count overflows leading to buffer overflow in journal recovery
Date 2015-06-03 14:20 +0200
Message-ID <pxfOl-E4-85@gated-at.bofh.it> (permalink)
References <pxfOh-E4-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Darrick J. Wong" <darrick.wong@oracle.com>

commit e531d0bceb402e643a4499de40dd3fa39d8d2e43 upstream.

The journal revoke block recovery code does not check r_count for
sanity, which means that an evil value of r_count could result in
the kernel reading off the end of the revoke table and into whatever
garbage lies beyond.  This could crash the kernel, so fix that.

However, in testing this fix, I discovered that the code to write
out the revoke tables also was not correctly checking to see if the
block was full -- the current offset check is fine so long as the
revoke table space size is a multiple of the record size, but this
is not true when either journal_csum_v[23] are set.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jbd2/recovery.c |   10 +++++++++-
 fs/jbd2/revoke.c   |   18 ++++++++++--------
 2 files changed, 19 insertions(+), 9 deletions(-)

--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t
 {
 	jbd2_journal_revoke_header_t *header;
 	int offset, max;
+	int csum_size = 0;
+	__u32 rcount;
 	int record_len = 4;
 
 	header = (jbd2_journal_revoke_header_t *) bh->b_data;
 	offset = sizeof(jbd2_journal_revoke_header_t);
-	max = be32_to_cpu(header->r_count);
+	rcount = be32_to_cpu(header->r_count);
 
 	if (!jbd2_revoke_block_csum_verify(journal, header))
 		return -EINVAL;
 
+	if (jbd2_journal_has_csum_v2or3(journal))
+		csum_size = sizeof(struct jbd2_journal_revoke_tail);
+	if (rcount > journal->j_blocksize - csum_size)
+		return -EINVAL;
+	max = rcount;
+
 	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
 		record_len = 8;
 
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -583,7 +583,7 @@ static void write_one_revoke_record(jour
 {
 	int csum_size = 0;
 	struct buffer_head *descriptor;
-	int offset;
+	int sz, offset;
 	journal_header_t *header;
 
 	/* If we are already aborting, this all becomes a noop.  We
@@ -600,9 +600,14 @@ static void write_one_revoke_record(jour
 	if (jbd2_journal_has_csum_v2or3(journal))
 		csum_size = sizeof(struct jbd2_journal_revoke_tail);
 
+	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+		sz = 8;
+	else
+		sz = 4;
+
 	/* Make sure we have a descriptor with space left for the record */
 	if (descriptor) {
-		if (offset >= journal->j_blocksize - csum_size) {
+		if (offset + sz > journal->j_blocksize - csum_size) {
 			flush_descriptor(journal, descriptor, offset, write_op);
 			descriptor = NULL;
 		}
@@ -625,16 +630,13 @@ static void write_one_revoke_record(jour
 		*descriptorp = descriptor;
 	}
 
-	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) {
+	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
 		* ((__be64 *)(&descriptor->b_data[offset])) =
 			cpu_to_be64(record->blocknr);
-		offset += 8;
-
-	} else {
+	else
 		* ((__be32 *)(&descriptor->b_data[offset])) =
 			cpu_to_be32(record->blocknr);
-		offset += 4;
-	}
+	offset += sz;
 
 	*offsetp = offset;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/64] 3.14.44-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 31/64] USB: pl2303: Remove support for Samsung I330 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 03/64] staging: rtl8712, rtl8712: avoid lots of build warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 19/64] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 58/64] sd: Disable support for 256 byte/sector disks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 29/64] xhci: gracefully handle xhci_irq dead device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 44/64] gpio: gpio-kempld: Fix get_direction return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 52/64] thermal: step_wise: Revert optimization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 08/64] net: socket: Fix the wrong returns for recvmsg and sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 56/64] Input: elantech - fix semi-mt protocol for v3 HW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 04/64] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 40/64] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 14/64] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 45/64] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 64/64] fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 41/64] libata: Add helper to determine when PHY events should be ignored Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 18/64] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:20 +0200
  [PATCH 3.14 32/64] USB: cp210x: add ID for KCF Technologies PRN device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 49/64] tools/vm: fix page-flags build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 53/64] md/raid5: dont record new size if resize_stripes fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 09/64] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 23/64] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 50/64] mm, numa: really disable NUMA balancing by default on single node machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 37/64] tty/n_gsm.c: fix a memory leak when gsmtty is removed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 35/64] powerpc: Align TOC to 256 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 11/64] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 51/64] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 12/64] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 07/64] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 10/64] xfs: xfs_iozero can return positive errno Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 54/64] md/raid0: fix restore to sector variable in raid0_make_request Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 3.14 55/64] rtlwifi: rtl8192cu: Fix kernel deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  Re: [PATCH 3.14 00/64] 3.14.44-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200

csiph-web