[PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le
Date	2016-08-08 21:20 +0200
Message-ID	<s3YfF-5sp-67@gated-at.bofh.it> (permalink)
References	<s3YfD-5sp-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Torsten Hilbrich <torsten.hilbrich@secunet.com>

commit 63d2f95d63396059200c391ca87161897b99e74a upstream.

The value `bytes' comes from the filesystem which is about to be
mounted.  We cannot trust that the value is always in the range we
expect it to be.

Check its value before using it to calculate the length for the crc32_le
call.  It value must be larger (or equal) sumoff + 4.

This fixes a kernel bug when accidentially mounting an image file which
had the nilfs2 magic value 0x3434 at the right offset 0x406 by chance.
The bytes 0x01 0x00 were stored at 0x408 and were interpreted as a
s_bytes value of 1.  This caused an underflow when substracting sumoff +
4 (20) in the call to crc32_le.

  BUG: unable to handle kernel paging request at ffff88021e600000
  IP:  crc32_le+0x36/0x100
  ...
  Call Trace:
    nilfs_valid_sb.part.5+0x52/0x60 [nilfs2]
    nilfs_load_super_block+0x142/0x300 [nilfs2]
    init_nilfs+0x60/0x390 [nilfs2]
    nilfs_mount+0x302/0x520 [nilfs2]
    mount_fs+0x38/0x160
    vfs_kern_mount+0x67/0x110
    do_mount+0x269/0xe00
    SyS_mount+0x9f/0x100
    entry_SYSCALL_64_fastpath+0x16/0x71

Link: http://lkml.kernel.org/r/1466778587-5184-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Tested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nilfs2/the_nilfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -443,7 +443,7 @@ static int nilfs_valid_sb(struct nilfs_s
 	if (!sbp || le16_to_cpu(sbp->s_magic) != NILFS_SUPER_MAGIC)
 		return 0;
 	bytes = le16_to_cpu(sbp->s_bytes);
-	if (bytes > BLOCK_SIZE)
+	if (bytes < sumoff + 4 || bytes > BLOCK_SIZE)
 		return 0;
 	crc = crc32_le(le32_to_cpu(sbp->s_crc_seed), (unsigned char *)sbp,
 		       sumoff);

Thread

[PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 36/68] locks: use file_inode() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 32/68] pinctrl: single: Fix missing flush of posted write for a wakeirq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 15/68] pps: do not crash when failed to register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 58/68] ipr: Clear interrupt on croc/crocodile when running with LSI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 10/68] fs/nilfs2: fix potential underflow in call to crc32_le Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 17/68] arc: unwind: warn only once if DW2_UNWIND is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 35/68] power_supply: power_supply_read_temp only if use_cnt > 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 56/68] RDS: fix rds_tcp_init() error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 68/68] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 26/68] Input: elantech - add more IC body types to the list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 42/68] spi: sunxi: fix transfer timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 47/68] block: fix use-after-free in sys_ioprio_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 37/68] Revert "ecryptfs: forbid opening files without mmap handler" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 25/68] Input: vmmouse - remove port reservation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 49/68] sched/fair: Fix effective_load() to consistently use smoothed load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 21/68] xenbus: dont bail early from xenbus_dev_request_and_reply() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 28/68] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 09/68] mm, compaction: abort free scanner if split fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 07/68] dmaengine: at_xdmac: double FIFO flush needed to compute residue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 55/68] can: fix oops caused by wrong rtnl dellink usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 52/68] can: at91_can: RX queue could get stuck at high bus load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 06/68] dmaengine: at_xdmac: fix residue corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 61/68] i2c: qup: Fix wrong value of index variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 45/68] platform/chrome: cros_ec_dev - double fetch bug in ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:20 +0200
  [PATCH 4.4 64/68] libceph: apply new_state before new_up_client on incrementals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 16/68] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 51/68] perf/x86: fix PEBS issues on Intel Atom/Core2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 14/68] vmlinux.lds: account for destructor sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 38/68] ecryptfs: dont allow mmap when the lower fs doesnt support it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 46/68] qeth: delete napi struct when removing a qeth device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 08/68] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 66/68] intel_th: pci: Add Kaby Lake PCH-H support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 41/68] namespace: update event counter when umounting a deleted dentry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 60/68] posix_cpu_timer: Exit early when process has been reaped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 54/68] can: fix handling of unmodifiable configuration options fix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 67/68] intel_th: Fix a deadlock in modprobing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 43/68] spi: sun4i: fix FIFO limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 11/68] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 39/68] ext4: verify extent header depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 12/68] mm, meminit: always return a valid node from early_pfn_to_nid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 63/68] libata: LITE-ON CX1-JB256-HP needs lower max_sectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 40/68] 9p: use file_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 57/68] SCSI: fix new bug in scsi_dev_info_list string matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 50/68] ovl: handle ATTR_KILL* Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 44/68] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 59/68] media: fix airspy usb probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 53/68] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 13/68] mm, meminit: ensure node is online before checking whether pages are uninitialised Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 48/68] mmc: block: fix packed command header endianness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 21:50 +0200
  [PATCH 4.4 34/68] cgroup: set css->id to -1 during init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 18/68] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 27/68] Input: xpad - fix oops when attaching an unknown Xbox One gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 29/68] Input: xpad - validate USB endpoint count during probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 19/68] xen/pciback: Fix conf_space read/write overlap check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 03/68] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  [PATCH 4.4 31/68] pvclock: Add CPU barriers to get correct version value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-08 22:00 +0200
  Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 06:30 +0200
    Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 10:30 +0200
      Re: [PATCH 4.4 00/68] 4.4.17-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-09 18:20 +0200
        Re: [PATCH 4.4 00/68] 4.4.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-09 19:30 +0200
  Re: [PATCH 4.4 00/68] 4.4.17-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-09 17:20 +0200

csiph-web