| Message ID | 20240305-effekt-luftzug-51913178f6cd@brauner (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | xattr: restrict vfs_getxattr_alloc() allocation size | expand |
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned values that amount to allocating about 8000GB worth of > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has > no reason to allow getting xattr values that are larger than > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr > values and nothing currently goes beyond that limit afaict. Let it check > for that and reject requests that are larger than that. > > Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1] > Signed-off-by: Christian Brauner <brauner@kernel.org> Makes sense. Reviewed-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned values that amount to allocating about 8000GB worth of > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has > no reason to allow getting xattr values that are larger than > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr > values and nothing currently goes beyond that limit afaict. Let it check > for that and reject requests that are larger than that. > > Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1] > Signed-off-by: Christian Brauner <brauner@kernel.org> Acked-by: Serge Hallyn <serge@hallyn.com> > --- > fs/xattr.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/xattr.c b/fs/xattr.c > index 09d927603433..a53c930e3018 100644 > --- a/fs/xattr.c > +++ b/fs/xattr.c > @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry, > if (error < 0) > return error; > > + if (error > XATTR_SIZE_MAX) > + return -E2BIG; > + > if (!value || (error > xattr_size)) { > value = krealloc(*xattr_value, error + 1, flags); > if (!value) > -- > 2.43.0 >
On Tue, 05 Mar 2024 13:27:06 +0100, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned values that amount to allocating about 8000GB worth of > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has > no reason to allow getting xattr values that are larger than > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr > values and nothing currently goes beyond that limit afaict. Let it check > for that and reject requests that are larger than that. > > [...] Applied to the vfs.misc branch of the vfs/vfs.git tree. Patches in the vfs.misc branch should appear in linux-next soon. Please report any outstanding bugs that were missed during review in a new review to the original patch series allowing us to drop it. It's encouraged to provide Acked-bys and Reviewed-bys even though the patch has now been applied. If possible patch trailers will be updated. Note that commit hashes shown below are subject to change due to rebase, trailer updates or similar. If in doubt, please check the listed branch. tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git branch: vfs.misc [1/1] xattr: restrict vfs_getxattr_alloc() allocation size https://git.kernel.org/vfs/vfs/c/82a4c8736d72
On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote: > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > where 9p returned values that amount to allocating about 8000GB worth of > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has > no reason to allow getting xattr values that are larger than > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr > values and nothing currently goes beyond that limit afaict. Let it check > for that and reject requests that are larger than that. > > Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1] > Signed-off-by: Christian Brauner <brauner@kernel.org> > --- > fs/xattr.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/xattr.c b/fs/xattr.c > index 09d927603433..a53c930e3018 100644 > --- a/fs/xattr.c > +++ b/fs/xattr.c > @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry, > if (error < 0) > return error; > > + if (error > XATTR_SIZE_MAX) > + return -E2BIG; > + > if (!value || (error > xattr_size)) { > value = krealloc(*xattr_value, error + 1, flags); > if (!value) I wonder if this should even categorized as a bug fix and get backported. Good catch! BR, Jarkko
On Thu Mar 7, 2024 at 10:01 PM EET, Jarkko Sakkinen wrote: > On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote: > > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api > > that does a racy query-size+allocate-buffer+retrieve-data. It is used by > > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues > > where 9p returned values that amount to allocating about 8000GB worth of > > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has > > no reason to allow getting xattr values that are larger than > > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr > > values and nothing currently goes beyond that limit afaict. Let it check > > for that and reject requests that are larger than that. > > > > Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1] > > Signed-off-by: Christian Brauner <brauner@kernel.org> > > --- > > fs/xattr.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/fs/xattr.c b/fs/xattr.c > > index 09d927603433..a53c930e3018 100644 > > --- a/fs/xattr.c > > +++ b/fs/xattr.c > > @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry, > > if (error < 0) > > return error; > > > > + if (error > XATTR_SIZE_MAX) > > + return -E2BIG; > > + > > if (!value || (error > xattr_size)) { > > value = krealloc(*xattr_value, error + 1, flags); > > if (!value) > > I wonder if this should even categorized as a bug fix and get > backported. Good catch! Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> BR, Jarkko
diff --git a/fs/xattr.c b/fs/xattr.c index 09d927603433..a53c930e3018 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry, if (error < 0) return error; + if (error > XATTR_SIZE_MAX) + return -E2BIG; + if (!value || (error > xattr_size)) { value = krealloc(*xattr_value, error + 1, flags); if (!value)
The vfs_getxattr_alloc() interface is a special-purpose in-kernel api that does a racy query-size+allocate-buffer+retrieve-data. It is used by EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues where 9p returned values that amount to allocating about 8000GB worth of memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has no reason to allow getting xattr values that are larger than XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr values and nothing currently goes beyond that limit afaict. Let it check for that and reject requests that are larger than that. Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1] Signed-off-by: Christian Brauner <brauner@kernel.org> --- fs/xattr.c | 3 +++ 1 file changed, 3 insertions(+)