xfs: underflow bug in xfs_attrlist_by_handle()
commit 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 upstream. If we allocate less than sizeof(struct attrlist) then we end up corrupting memory or doing a ZERO_PTR_SIZE dereference. This can only be triggered with CAP_SYS_ADMIN. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
7e767aae0e
commit
f75eb9d408
|
@ -409,7 +409,8 @@ xfs_attrlist_by_handle(
|
|||
return -XFS_ERROR(EPERM);
|
||||
if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
|
||||
return -XFS_ERROR(EFAULT);
|
||||
if (al_hreq.buflen > XATTR_LIST_MAX)
|
||||
if (al_hreq.buflen < sizeof(struct attrlist) ||
|
||||
al_hreq.buflen > XATTR_LIST_MAX)
|
||||
return -XFS_ERROR(EINVAL);
|
||||
|
||||
/*
|
||||
|
|
|
@ -359,7 +359,8 @@ xfs_compat_attrlist_by_handle(
|
|||
if (copy_from_user(&al_hreq, arg,
|
||||
sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
|
||||
return -XFS_ERROR(EFAULT);
|
||||
if (al_hreq.buflen > XATTR_LIST_MAX)
|
||||
if (al_hreq.buflen < sizeof(struct attrlist) ||
|
||||
al_hreq.buflen > XATTR_LIST_MAX)
|
||||
return -XFS_ERROR(EINVAL);
|
||||
|
||||
/*
|
||||
|
|
Loading…
Reference in New Issue