korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-11 21:38:32 +08:00
Code Issues Packages Projects Releases Wiki Activity
714,591 Commits 111 Branches 5,165 Tags 3.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
ef3cf941e0
Go to file
Jann Horn ef3cf941e0 reiserfs: fix broken xattr handling (heap corruption, bad retval) 
commit a13f085d11 upstream.

This fixes the following issues:

- When a buffer size is supplied to reiserfs_listxattr() such that each
  individual name fits, but the concatenation of all names doesn't fit,
  reiserfs_listxattr() overflows the supplied buffer.  This leads to a
  kernel heap overflow (verified using KASAN) followed by an out-of-bounds
  usercopy and is therefore a security bug.

- When a buffer size is supplied to reiserfs_listxattr() such that a
  name doesn't fit, -ERANGE should be returned.  But reiserfs instead just
  truncates the list of names; I have verified that if the only xattr on a
  file has a longer name than the supplied buffer length, listxattr()
  incorrectly returns zero.

With my patch applied, -ERANGE is returned in both cases and the memory
corruption doesn't happen anymore.

Credit for making me clean this code up a bit goes to Al Viro, who pointed
out that the ->actor calling convention is suboptimal and should be
changed.

Link: http://lkml.kernel.org/r/20180802151539.5373-1-jannh@google.com
Fixes: 48b32a3553 ("reiserfs: use generic xattr handlers")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-24 13:09:23 +02:00
arch parisc: Remove unnecessary barriers from spinlock.h 2018-08-24 13:09:22 +02:00
block block: sed-opal: Fix a couple off by one bugs 2018-08-24 13:09:03 +02:00
certs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crypto crypto: skcipher - fix crash flushing dcache in error path 2018-08-17 21:01:10 +02:00
Documentation kbuild: verify that $DEPMOD is installed 2018-08-17 21:01:10 +02:00
drivers i2c: imx: Fix race condition in dma read 2018-08-24 13:09:23 +02:00
firmware License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs reiserfs: fix broken xattr handling (heap corruption, bad retval) 2018-08-24 13:09:23 +02:00
include PCI: OF: Fix I/O space page leak 2018-08-24 13:09:19 +02:00
init init: rename and re-order boot_cpu_state_init() 2018-08-15 18:12:48 +02:00
ipc ipc/shm: fix shmat() nil address after round-down when remapping 2018-05-30 07:51:49 +02:00
kernel tracing: Use __printf markup to silence compiler 2018-08-24 13:09:12 +02:00
lib ioremap: Update pgtable free interfaces with addr 2018-08-17 21:01:11 +02:00
mm kasan: fix shadow_size calculation error in kasan_module_alloc 2018-08-24 13:09:12 +02:00
net net/smc: no shutdown in state SMC_LISTEN 2018-08-24 13:09:22 +02:00
samples samples/bpf: Check the error of write() and read() 2018-08-24 13:09:12 +02:00
scripts kconfig: fix line numbers for if-entries in menu tree 2018-08-24 13:09:06 +02:00
security Smack: Mark inode instant in smack_task_to_inode 2018-08-24 13:09:04 +02:00
sound ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl 2018-08-24 13:09:05 +02:00
tools tools: build: Use HOSTLDFLAGS with fixdep 2018-08-24 13:09:17 +02:00
usr initramfs: fix initramfs rebuilds w/ compression after disabling 2017-11-03 07:39:19 -07:00
virt KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer 2018-08-24 13:09:21 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS dt-bindings: Document mti,mips-cpc binding 2018-03-15 10:54:35 +01:00
Makefile kbuild: suppress warnings from 'getconf LFS_*' 2018-08-24 13:09:17 +02:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.