[PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB... Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com ---
Hello Jincheng, can you please give this fix a try?
Thanks! Miquèl
fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos; + u16 name_size;
dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) { @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; }
- /* Set entry name */ - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); - dent->name[dirs->entry->name_size + 1] = '\0'; + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1); + strncpy(dent->name, dirs->entry->name, name_size); + dent->name[name_size] = '\0';
offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256 + /** * struct fs_dirent - directory entry * @@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */ - char name[256]; + char name[FS_DIRENT_NAME_LEN]; };
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
It works well, thanks for your work.
Miquel Raynal miquel.raynal@bootlin.com 于2022年6月3日周五 23:26写道：
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB... Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com
Hello Jincheng, can you please give this fix a try?
Thanks! Miquèl
fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos;
u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) {@@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; }
/* Set entry name */strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);dent->name[dirs->entry->name_size + 1] = '\0';
/* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1);strncpy(dent->name, dirs->entry->name, name_size);dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--;diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
/**
- struct fs_dirent - directory entry
@@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */
char name[256];
char name[FS_DIRENT_NAME_LEN];};
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
2.34.1
On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
It works well, thanks for your work.
Can you please provide a Tested-by? Thanks!
Miquel Raynal miquel.raynal@bootlin.com 于2022年6月3日周五 23:26写道：
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB... Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com
Hello Jincheng, can you please give this fix a try?
Thanks! Miquèl
fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos;
u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) {@@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; }
/* Set entry name */strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);dent->name[dirs->entry->name_size + 1] = '\0';
/* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1);strncpy(dent->name, dirs->entry->name, name_size);dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--;diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
/**
- struct fs_dirent - directory entry
@@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */
char name[256];
char name[FS_DIRENT_NAME_LEN];};
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
2.34.1
To be honest, I don't have experience....
Reference to the article " https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maint..." , I tried to do some work.
1. checkpatch (√) 2. no new compile warnings (√) 3. if bug fix, verify the bug is fixed (√) I tried some vul-samples, and the patch solved them well. 4. if new feature, feature matches documentation (×) I try some normal samples, and there is a bug. The dir name or filename loses a byte. You can use the attachment to check it. I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to create the squashfs sample.
```before patch => ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hello BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 1 file(s), 0 dir(s) ```
```after patch => ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hell BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096
1 file(s), 0 dir(s) ```
Tom Rini trini@konsulko.com 于2022年6月7日周二 21:43写道：
On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
It works well, thanks for your work.
Can you please provide a Tested-by? Thanks!
Miquel Raynal miquel.raynal@bootlin.com 于2022年6月3日周五 23:26写道：
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link:
https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB...
Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com
Hello Jincheng, can you please give this fix a try?
Thanks! Miquèl
fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
struct fs_dirent **dentp)
int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos;
u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) {@@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
struct fs_dirent **dentp)
return -SQFS_STOP_READDIR; }
/* Set entry name */strncpy(dent->name, dirs->entry->name, dirs->entry->name_size
- 1);
dent->name[dirs->entry->name_size + 1] = '\0';
/* Set entry name (capped at FS_DIRENT_NAME_LEN which is aU-Boot limitation) */
name_size = min_t(u16, dirs->entry->name_size,FS_DIRENT_NAME_LEN - 1);
strncpy(dent->name, dirs->entry->name, name_size);dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--;diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr,
loff_t offset, loff_t len,
#define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
/**
- struct fs_dirent - directory entry
@@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */
char name[256];
char name[FS_DIRENT_NAME_LEN];};
/* Note: fs_dir_stream should be treated as opaque to the user of fs
layer */
-- 2.34.1
-- Tom
Hi Jincheng,
jc.w4ng@gmail.com wrote on Wed, 8 Jun 2022 11:37:13 +0800:
To be honest, I don't have experience....
Reference to the article " https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maint..." , I tried to do some work.
- checkpatch (√)
- no new compile warnings (√)
- if bug fix, verify the bug is fixed (√) I tried some vul-samples, and the patch solved them well.
- if new feature, feature matches documentation (×) I try some normal samples, and there is a bug. The dir name or
filename loses a byte. You can use the attachment to check it. I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to create the squashfs sample.
What we are asking for is just you replying plain text to this thread with this line: "Tested-by: <you> <youraddress>"
This "tag" will automatically be picked-up by the tools used by the maintainers when applying the patch, to trace who did what.
=> ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hello BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 1 file(s), 0 dir(s)=> ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hell BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 1 file(s), 0 dir(s)Tom Rini trini@konsulko.com 于2022年6月7日周二 21:43写道：
On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
It works well, thanks for your work.
Can you please provide a Tested-by? Thanks!
Miquel Raynal miquel.raynal@bootlin.com 于2022年6月3日周五 23:26写道：
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link:
https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB...
Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com
Hello Jincheng, can you please give this fix a try?
Thanks! Miquèl
fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
struct fs_dirent **dentp)
int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos;
u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) {@@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
struct fs_dirent **dentp)
return -SQFS_STOP_READDIR; }
/* Set entry name */strncpy(dent->name, dirs->entry->name, dirs->entry->name_size
- 1);
dent->name[dirs->entry->name_size + 1] = '\0';
/* Set entry name (capped at FS_DIRENT_NAME_LEN which is aU-Boot limitation) */
name_size = min_t(u16, dirs->entry->name_size,FS_DIRENT_NAME_LEN - 1);
strncpy(dent->name, dirs->entry->name, name_size);dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--;diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr,
loff_t offset, loff_t len,
#define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
/**
- struct fs_dirent - directory entry
@@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */
char name[256];
char name[FS_DIRENT_NAME_LEN];};
/* Note: fs_dir_stream should be treated as opaque to the user of fs
layer */
-- 2.34.1
-- Tom
Thanks, Miquèl
participants (3)
-
Jincheng Wang -
Miquel Raynal -
Tom Rini