From patchwork Tue Nov 20 05:36:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chandan Rajendra X-Patchwork-Id: 10689873 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CC27D14BD for ; Tue, 20 Nov 2018 05:36:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AA9D029E8B for ; Tue, 20 Nov 2018 05:36:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 984972A3A5; Tue, 20 Nov 2018 05:36:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 217BD29E8B for ; Tue, 20 Nov 2018 05:36:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730962AbeKTQEL (ORCPT ); Tue, 20 Nov 2018 11:04:11 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:60290 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726883AbeKTQEL (ORCPT ); Tue, 20 Nov 2018 11:04:11 -0500 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id wAK5YjOx031771 for ; Tue, 20 Nov 2018 00:36:54 -0500 Received: from e13.ny.us.ibm.com (e13.ny.us.ibm.com [129.33.205.203]) by mx0a-001b2d01.pphosted.com with ESMTP id 2nvavctttm-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 20 Nov 2018 00:36:54 -0500 Received: from localhost by e13.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 20 Nov 2018 05:36:52 -0000 Received: from b01cxnp22035.gho.pok.ibm.com (9.57.198.25) by e13.ny.us.ibm.com (146.89.104.200) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 20 Nov 2018 05:36:49 -0000 Received: from b01ledav005.gho.pok.ibm.com (b01ledav005.gho.pok.ibm.com [9.57.199.110]) by b01cxnp22035.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id wAK5ancF47513844 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 20 Nov 2018 05:36:49 GMT Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E8224AE060; Tue, 20 Nov 2018 05:36:48 +0000 (GMT) Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 885C9AE064; Tue, 20 Nov 2018 05:36:47 +0000 (GMT) Received: from localhost.in.ibm.com (unknown [9.124.35.69]) by b01ledav005.gho.pok.ibm.com (Postfix) with ESMTP; Tue, 20 Nov 2018 05:36:47 +0000 (GMT) From: Chandan Rajendra To: linux-fsdevel@vger.kernel.org Cc: Chandan Rajendra , viro@zeniv.linux.org.uk, joe@perches.com, abdhalee@linux.vnet.ibm.com Subject: [PATCH RESEND] get_fs_type: Validate fs type string argument Date: Tue, 20 Nov 2018 11:06:42 +0530 X-Mailer: git-send-email 2.19.1 MIME-Version: 1.0 X-TM-AS-GCONF: 00 x-cbid: 18112005-0064-0000-0000-000003772091 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00010085; HX=3.00000242; KW=3.00000007; PH=3.00000004; SC=3.00000270; SDB=6.01120032; UDB=6.00580469; IPR=6.00900154; MB=3.00024239; MTD=3.00000008; XFM=3.00000015; UTC=2018-11-20 05:36:50 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18112005-0065-0000-0000-00003B644C83 Message-Id: <20181120053642.24513-1-chandan@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-11-20_02:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=930 adultscore=2 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1811200050 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On ppc64le, When a string with PAGE_SIZE - 1 (i.e. 64k-1) length is passed as a "filesystem type" argument to the mount(2) syscall, copy_mount_string() ends up allocating 64k (the PAGE_SIZE on ppc64le) worth of space for holding the string in kernel's address space. Later, in set_precision() (invoked by get_fs_type() -> __request_module() -> vsnprintf()), we end up assigning strlen(fs-type-string) i.e. 65535 as the value to 'struct printf_spec'->precision member. This field has a width of 16 bits and it is a signed data type. Hence an invalid value ends up getting assigned. This causes the "WARN_ONCE(spec->precision != prec, "precision %d too large", prec)" statement inside set_precision() to be executed. This commit fixes the bug by validating the length of the "filesystem type" argument passed to get_fs_type() function. Signed-off-by: Chandan Rajendra Reported-by: Abdul Haleem Suggested-by: Joe Perches Acked-by: Miklos Szeredi --- fs/filesystems.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/filesystems.c b/fs/filesystems.c index 9135646e41ac..a61caf5b6ad3 100644 --- a/fs/filesystems.c +++ b/fs/filesystems.c @@ -268,6 +268,9 @@ struct file_system_type *get_fs_type(const char *name) const char *dot = strchr(name, '.'); int len = dot ? dot - name : strlen(name); + if (len >= PATH_MAX) + return NULL; + fs = __get_fs_type(name, len); if (!fs && (request_module("fs-%.*s", len, name) == 0)) { fs = __get_fs_type(name, len);