mirror of
https://github.com/edk2-porting/linux-next.git
synced 2025-01-20 03:24:03 +08:00
26982a89ca
AFS has a structured layout in its directory contents (AFS dirs are downloaded as files and parsed locally by the client for lookup/readdir). The slots in the directory are defined by union afs_xdr_dirent. This, however, only directly allows a name of a length that will fit into that union. To support a longer name, the next 1-8 contiguous entries are annexed to the first one and the name flows across these. afs_dir_iterate_block() uses strnlen(), limited to the space to the end of the page, to find out how long the name is. This worked fine until6a39e62abb. With that commit, the compiler determines the size of the array and asserts that the string fits inside that array. This is a problem for AFS because we *expect* it to overflow one or more arrays. A similar problem also occurs in afs_dir_scan_block() when a directory file is being locally edited to avoid the need to redownload it. There strlen() was being used safely because each page has the last byte set to 0 when the file is downloaded and validated (in afs_dir_check_page()). Fix this by changing the afs_xdr_dirent union name field to an indeterminate-length array and dropping the overflow field. (Note that whilst looking at this, I realised that the calculation of the number of slots a dirent used is non-standard and not quite right, but I'll address that in a separate patch.) The issue can be triggered by something like: touch /afs/example.com/thisisaveryveryverylongname and it generates a report that looks like: detected buffer overflow in strnlen ------------[ cut here ]------------ kernel BUG at lib/string.c:1149! ... RIP: 0010:fortify_panic+0xf/0x11 ... Call Trace: afs_dir_iterate_block+0x12b/0x35b afs_dir_iterate+0x14e/0x1ce afs_do_lookup+0x131/0x417 afs_lookup+0x24f/0x344 lookup_open.isra.0+0x1bb/0x27d open_last_lookups+0x166/0x237 path_openat+0xe0/0x159 do_filp_open+0x48/0xa4 ? kmem_cache_alloc+0xf5/0x16e ? __clear_close_on_exec+0x13/0x22 ? _raw_spin_unlock+0xa/0xb do_sys_openat2+0x72/0xde do_sys_open+0x3b/0x58 do_syscall_64+0x2d/0x3a entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes:6a39e62abb("lib: string.h: detect intra-object overflow in fortified string functions") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Marc Dionne <marc.dionne@auristor.com> cc: Daniel Axtens <dja@axtens.net>
105 lines
2.3 KiB
C
105 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/* AFS fileserver XDR types
|
|
*
|
|
* Copyright (C) 2018 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*/
|
|
|
|
#ifndef XDR_FS_H
|
|
#define XDR_FS_H
|
|
|
|
struct afs_xdr_AFSFetchStatus {
|
|
__be32 if_version;
|
|
#define AFS_FSTATUS_VERSION 1
|
|
__be32 type;
|
|
__be32 nlink;
|
|
__be32 size_lo;
|
|
__be32 data_version_lo;
|
|
__be32 author;
|
|
__be32 owner;
|
|
__be32 caller_access;
|
|
__be32 anon_access;
|
|
__be32 mode;
|
|
__be32 parent_vnode;
|
|
__be32 parent_unique;
|
|
__be32 seg_size;
|
|
__be32 mtime_client;
|
|
__be32 mtime_server;
|
|
__be32 group;
|
|
__be32 sync_counter;
|
|
__be32 data_version_hi;
|
|
__be32 lock_count;
|
|
__be32 size_hi;
|
|
__be32 abort_code;
|
|
} __packed;
|
|
|
|
#define AFS_DIR_HASHTBL_SIZE 128
|
|
#define AFS_DIR_DIRENT_SIZE 32
|
|
#define AFS_DIR_SLOTS_PER_BLOCK 64
|
|
#define AFS_DIR_BLOCK_SIZE 2048
|
|
#define AFS_DIR_BLOCKS_PER_PAGE (PAGE_SIZE / AFS_DIR_BLOCK_SIZE)
|
|
#define AFS_DIR_MAX_SLOTS 65536
|
|
#define AFS_DIR_BLOCKS_WITH_CTR 128
|
|
#define AFS_DIR_MAX_BLOCKS 1023
|
|
#define AFS_DIR_RESV_BLOCKS 1
|
|
#define AFS_DIR_RESV_BLOCKS0 13
|
|
|
|
/*
|
|
* Directory entry structure.
|
|
*/
|
|
union afs_xdr_dirent {
|
|
struct {
|
|
u8 valid;
|
|
u8 unused[1];
|
|
__be16 hash_next;
|
|
__be32 vnode;
|
|
__be32 unique;
|
|
u8 name[];
|
|
/* When determining the number of dirent slots needed to
|
|
* represent a directory entry, name should be assumed to be 16
|
|
* bytes, due to a now-standardised (mis)calculation, but it is
|
|
* in fact 20 bytes in size.
|
|
*
|
|
* For names longer than (16 or) 20 bytes, extra slots should
|
|
* be annexed to this one using the extended_name format.
|
|
*/
|
|
} u;
|
|
u8 extended_name[32];
|
|
} __packed;
|
|
|
|
/*
|
|
* Directory block header (one at the beginning of every 2048-byte block).
|
|
*/
|
|
struct afs_xdr_dir_hdr {
|
|
__be16 npages;
|
|
__be16 magic;
|
|
#define AFS_DIR_MAGIC htons(1234)
|
|
u8 reserved;
|
|
u8 bitmap[8];
|
|
u8 pad[19];
|
|
} __packed;
|
|
|
|
/*
|
|
* Directory block layout
|
|
*/
|
|
union afs_xdr_dir_block {
|
|
struct afs_xdr_dir_hdr hdr;
|
|
|
|
struct {
|
|
struct afs_xdr_dir_hdr hdr;
|
|
u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS];
|
|
__be16 hashtable[AFS_DIR_HASHTBL_SIZE];
|
|
} meta;
|
|
|
|
union afs_xdr_dirent dirents[AFS_DIR_SLOTS_PER_BLOCK];
|
|
} __packed;
|
|
|
|
/*
|
|
* Directory layout on a linux VM page.
|
|
*/
|
|
struct afs_xdr_dir_page {
|
|
union afs_xdr_dir_block blocks[AFS_DIR_BLOCKS_PER_PAGE];
|
|
};
|
|
|
|
#endif /* XDR_FS_H */
|