Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs
History
Jann Horn 2ffd618642 fuse: use unsigned type for getxattr/listxattr size truncation 
commit b18915248a15eae7d901262f108d6ff0ffb4ffc1 upstream.

The existing code uses min_t(ssize_t, outarg.size, XATTR_LIST_MAX) when
parsing the FUSE daemon's response to a zero-length getxattr/listxattr
request.
On 32-bit kernels, where ssize_t and outarg.size are the same size, this is
wrong: The min_t() will pass through any size values that are negative when
interpreted as signed.
fuse_listxattr() will then return this userspace-supplied negative value,
which callers will treat as an error value.

This kind of bug pattern can lead to fairly bad security bugs because of
how error codes are used in the Linux kernel. If a caller were to convert
the numeric error into an error pointer, like so:

    struct foo *func(...) {
      int len = fuse_getxattr(..., NULL, 0);
      if (len < 0)
        return ERR_PTR(len);
      ...
    }

then it would end up returning this userspace-supplied negative value cast
to a pointer - but the caller of this function wouldn't recognize it as an
error pointer (IS_ERR_VALUE() only detects values in the narrow range in
which legitimate errno values are), and so it would just be treated as a
kernel pointer.

I think there is at least one theoretical codepath where this could happen,
but that path would involve virtio-fs with submounts plus some weird
SELinux configuration, so I think it's probably not a concern in practice.

Cc: stable@vger.kernel.org # v4.9
Fixes: 63401ccdb2ca ("fuse: limit xattr returned size")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-23 23:21:00 +01:00
..
9p fs/9p: drop inodes immediately on non-.L too 2024-11-19 11:32:45 +01:00
adfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
affs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
afs afs: Don't cross .backup mountpoint from backup volume 2024-11-19 12:27:12 +01:00
autofs Revert "file: Replace ksys_close with close_fd" 2024-11-19 12:59:08 +01:00
befs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btrfs btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() 2024-11-23 23:20:46 +01:00
cachefiles Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
ceph ceph: fix incorrect kmalloc size of pagevec mempool 2024-11-23 23:20:18 +01:00
cifs smb: client: fix deadlock in smb2_find_smb_tcon() 2024-11-19 14:19:30 +01:00
coda Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs debugfs: fix automount d_fsdata usage 2024-11-18 12:12:12 +01:00
devpts Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecryptfs Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
efivarfs efivarfs: force RO when remounting if SetVariable is not supported 2024-11-18 12:12:25 +01:00
efs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
erofs BACKPORT: erofs: fix lz4 inplace decompression 2024-11-17 17:41:30 +01:00
exfat exfat: support handle zero-size directory 2024-11-18 11:43:14 +01:00
exportfs exportfs: use pr_debug for unreachable debug statements 2024-11-19 12:28:26 +01:00
ext2 ext2: Verify bitmap and itable block numbers before using them 2024-11-23 23:20:12 +01:00
ext4 ext4: handle redirtying in ext4_bio_write_page() 2024-11-23 23:20:59 +01:00
f2fs f2fs: fix to do sanity check in update_sit_entry 2024-11-23 23:20:46 +01:00
fat fat: fix uninitialized field in nostale filehandles 2024-11-19 09:22:16 +01:00
freevxfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fscache Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fuse fuse: use unsigned type for getxattr/listxattr size truncation 2024-11-23 23:21:00 +01:00
gfs2 gfs2: setattr_chown: Add missing initialization 2024-11-23 23:20:45 +01:00
hfs hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() 2024-11-23 23:20:12 +01:00
hfsplus hfsplus: fix to avoid false alarm of circular locking 2024-11-23 23:19:56 +01:00
hostfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hpfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hugetlbfs fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super 2024-11-18 23:18:30 +01:00
incfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomap Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
isofs isofs: handle CDs with bad root inode but good Joliet root directory 2024-11-19 09:23:14 +01:00
jbd2 jbd2: avoid memleak in jbd2_journal_write_metadata_buffer 2024-11-23 23:20:24 +01:00
jffs2 jffs2: Fix potential illegal address access in jffs2_free_inode 2024-11-19 14:19:41 +01:00
jfs jfs: Fix array-index-out-of-bounds in diFree 2024-11-23 23:20:16 +01:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-11-18 12:13:20 +01:00
lockd lockd: drop inappropriate svc_get() from locked_get() 2024-11-19 12:28:32 +01:00
minix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfs NFS: avoid infinite loop in pnfs_update_layout. 2024-11-23 23:20:47 +01:00
nfs_common NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs 2024-11-19 12:27:35 +01:00
nfsd nfsd: hold a lighter-weight client reference over CB_RECALL_ANY 2024-11-19 14:19:31 +01:00
nilfs2 nilfs2: handle inconsistent state in nilfs_btnode_create_block() 2024-11-23 23:20:16 +01:00
nls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notify fsnotify: clear PARENT_WATCHED flags lazily 2024-11-23 23:20:58 +01:00
ntfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2 ocfs2: add bounds checking to ocfs2_check_dir_entry() 2024-11-19 14:19:51 +01:00
omfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openpromfs openpromfs: finish conversion to the new mount API 2024-11-19 12:26:52 +01:00
orangefs orangefs: fix out-of-bounds fsid access 2024-11-19 14:19:41 +01:00
overlayfs Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
proc sysctl: always initialize i_uid/i_gid 2024-11-23 23:20:19 +01:00
pstore pstore/zone: Add a null pointer check to the psz_kmsg_read 2024-11-19 09:23:13 +01:00
qnx4 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qnx6 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota quota: Remove BUG_ON from dqget() 2024-11-23 23:20:45 +01:00
ramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reiserfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
romfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdfat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
squashfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-11-19 11:32:23 +01:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-11-19 09:23:14 +01:00
tracefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ubifs ubifs: Set page uptodate in the correct place 2024-11-19 09:22:16 +01:00
udf udf: Limit file size to 4TB 2024-11-23 23:20:59 +01:00
ufs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unicode Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vboxsf vboxsf: Avoid an spurious warning if load_nls_xxx() fails 2024-11-19 09:22:46 +01:00
verity Revert "fs: add file and path permissions helpers" 2024-11-19 13:30:21 +01:00
xfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zonefs zonefs: Improve error handling 2024-11-18 22:25:32 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-11-19 09:22:39 +01:00
anon_inodes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
attr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bad_inode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_aout.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_elf_fdpic.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_em86.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_flat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_misc.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_script.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block_dev.c block: Don't invalidate pagecache for invalid falloc modes 2024-11-18 12:12:06 +01:00
buffer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
char_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat_binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
coredump.c exec: Simplify unshare_files 2024-11-19 12:27:27 +01:00
d_path.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dax.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.c fs: better handle deep ancestor chains in is_subdir() 2024-11-19 14:19:50 +01:00
dcookies.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
direct-io.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlog_hook.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drop_caches.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventpoll.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec.c exec: Fix ToCToU between perm check and set-uid/gid usage 2024-11-23 23:20:31 +01:00
fcntl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-11-19 08:44:37 +01:00
file.c fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE 2024-11-23 23:20:42 +01:00
file_table.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filesystems.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs-writeback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_context.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_parser.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_pin.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_struct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_types.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fsopen.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Revert "fs: add file and path permissions helpers" 2024-11-19 13:30:21 +01:00
inode.c vfs: Don't evict inode under the inode lru traversing context 2024-11-23 23:20:42 +01:00
internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.c lsm: new security_file_ioctl_compat() hook 2024-11-18 12:12:58 +01:00
Kconfig NFSD: Remove CONFIG_NFSD_V3 2024-11-19 12:27:54 +01:00
Kconfig.binfmt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kernel_read_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
libfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.c filelock: Fix fcntl/close race recovery compat path 2024-11-19 14:19:53 +01:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mbcache.c mbcache: Speed up cache entry creation 2024-11-19 17:58:19 +01:00
mount.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpage.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namei.c Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
namespace.c fs: indicate request originates from old mount API 2024-11-18 12:12:26 +01:00
no-block.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
open.c ftruncate: pass a signed offset 2024-11-19 14:19:34 +01:00
pipe.c pipe: wakeup wr_wait after setting max_usage 2024-11-18 12:13:04 +01:00
pnode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
posix_acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
proc_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
read_write.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
readdir.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
remap_range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
select.c fs/select: rework stack allocation hack for clang 2024-11-19 08:44:37 +01:00
seq_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
signalfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
splice.c splice: don't generate zero-len segement bvecs 2024-11-19 17:42:24 +01:00
stack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
statfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT 2024-11-23 23:20:18 +01:00
sync.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
timerfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
userfaultfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utimes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00