[PATCH v2] fs: btrfs: fix out of bounds write
Fix btrfs_read/read_and_truncate_page write out of bounds of destination buffer. Old behavior break bootstd malloc'd buffers of exact file size. Previously this OOB write have not been noticed because distroboot usually read files into huge static memory areas.
Signed-off-by: Alex Shumsky alexthreed@gmail.com Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()") ---
Changes in v2: - fix error path handling - add Fixes tag - use min3
fs/btrfs/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4691612eda..3998ffc2c8 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path, extent_type = btrfs_file_extent_type(leaf, fi); if (extent_type == BTRFS_FILE_EXTENT_INLINE) { ret = btrfs_read_extent_inline(path, fi, buf); - memcpy(dest, buf + page_off, min(page_len, ret)); + if (ret < 0) { + free(buf); + return ret; + } + memcpy(dest, buf + page_off, min3(page_len, ret, len)); free(buf); return len; } @@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path, free(buf); return ret; } - memcpy(dest, buf + page_off, page_len); + memcpy(dest, buf + page_off, min(page_len, len)); free(buf); return len; }
在 2024/6/19 07:11, Alex Shumsky 写道:
Fix btrfs_read/read_and_truncate_page write out of bounds of destination buffer. Old behavior break bootstd malloc'd buffers of exact file size. Previously this OOB write have not been noticed because distroboot usually read files into huge static memory areas.
Signed-off-by: Alex Shumsky alexthreed@gmail.com Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
Reviewed-by: Qu Wenruo wqu@suse.com
Thanks, Qu
Changes in v2:
fix error path handling
add Fixes tag
use min3
fs/btrfs/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4691612eda..3998ffc2c8 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path, extent_type = btrfs_file_extent_type(leaf, fi); if (extent_type == BTRFS_FILE_EXTENT_INLINE) { ret = btrfs_read_extent_inline(path, fi, buf);
memcpy(dest, buf + page_off, min(page_len, ret));
if (ret < 0) {free(buf);return ret;}memcpy(dest, buf + page_off, min3(page_len, ret, len));@@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path, free(buf); return ret; }
- memcpy(dest, buf + page_off, page_len);
- memcpy(dest, buf + page_off, min(page_len, len)); free(buf); return len; }
Hi all,
Is there something on my side needed to push this forward?
On Wed, Jun 19, 2024 at 12:41 AM Alex Shumsky alexthreed@gmail.com wrote:
Fix btrfs_read/read_and_truncate_page write out of bounds of destination buffer. Old behavior break bootstd malloc'd buffers of exact file size. Previously this OOB write have not been noticed because distroboot usually read files into huge static memory areas.
Signed-off-by: Alex Shumsky alexthreed@gmail.com Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
Changes in v2:
- fix error path handling
- add Fixes tag
- use min3
fs/btrfs/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4691612eda..3998ffc2c8 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path, extent_type = btrfs_file_extent_type(leaf, fi); if (extent_type == BTRFS_FILE_EXTENT_INLINE) { ret = btrfs_read_extent_inline(path, fi, buf);
memcpy(dest, buf + page_off, min(page_len, ret));
if (ret < 0) {free(buf);return ret;}memcpy(dest, buf + page_off, min3(page_len, ret, len)); free(buf); return len; }@@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path, free(buf); return ret; }
memcpy(dest, buf + page_off, page_len);
memcpy(dest, buf + page_off, min(page_len, len)); free(buf); return len;}
2.34.1
On Tue, Jun 25, 2024 at 01:22:01AM +0300, Alex ThreeD wrote:
Hi all,
Is there something on my side needed to push this forward?
I will pick it up for -next in a while, thanks.
On Wed, Jun 19, 2024 at 12:41 AM Alex Shumsky alexthreed@gmail.com wrote:
Fix btrfs_read/read_and_truncate_page write out of bounds of destination buffer. Old behavior break bootstd malloc'd buffers of exact file size. Previously this OOB write have not been noticed because distroboot usually read files into huge static memory areas.
Signed-off-by: Alex Shumsky alexthreed@gmail.com Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
Changes in v2:
- fix error path handling
- add Fixes tag
- use min3
fs/btrfs/inode.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 4691612eda..3998ffc2c8 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path, extent_type = btrfs_file_extent_type(leaf, fi); if (extent_type == BTRFS_FILE_EXTENT_INLINE) { ret = btrfs_read_extent_inline(path, fi, buf);
memcpy(dest, buf + page_off, min(page_len, ret));
if (ret < 0) {free(buf);return ret;}memcpy(dest, buf + page_off, min3(page_len, ret, len)); free(buf); return len; }@@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path, free(buf); return ret; }
memcpy(dest, buf + page_off, page_len);
memcpy(dest, buf + page_off, min(page_len, len)); free(buf); return len;}
2.34.1
On Wed, 19 Jun 2024 00:41:38 +0300, Alex Shumsky wrote:
Fix btrfs_read/read_and_truncate_page write out of bounds of destination buffer. Old behavior break bootstd malloc'd buffers of exact file size. Previously this OOB write have not been noticed because distroboot usually read files into huge static memory areas.
Applied to u-boot/next, thanks!
participants (4)
-
Alex Shumsky -
Alex ThreeD
-
Qu Wenruo -
Tom Rini