52 lines
1.6 KiB
Diff
52 lines
1.6 KiB
Diff
|
From 49cab731abe7a98db4ac16666e3b5ab3bc799282 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Richard Weinberger <richard@nod.at>
|
||
|
|
Date: Fri, 9 Aug 2024 11:54:28 +0200
|
||
|
|
Subject: [PATCH 3/8] ext4: Fix integer overflow in ext4fs_read_symlink()
|
||
|
|
|
||
|
|
While zalloc() takes a size_t type, adding 1 to the le32 variable
|
||
|
|
will overflow.
|
||
|
|
A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
|
||
|
|
and as consequence zalloc() will do a zero allocation.
|
||
|
|
|
||
|
|
Later in the function the inode size is again used for copying data.
|
||
|
|
So an attacker can overwrite memory.
|
||
|
|
|
||
|
|
Avoid the overflow by using the __builtin_add_overflow() helper.
|
||
|
|
|
||
|
|
Signed-off-by: Richard Weinberger <richard@nod.at>
|
||
|
|
|
||
|
|
CVE: CVE-2024-57256
|
||
|
|
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/35f75d2a46e5859138c83a75cd2f4141c5479ab9]
|
||
|
|
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
||
|
|
---
|
||
|
|
fs/ext4/ext4_common.c | 7 ++++++-
|
||
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
|
||
|
|
index f50de7c0..a7798296 100644
|
||
|
|
--- a/fs/ext4/ext4_common.c
|
||
|
|
+++ b/fs/ext4/ext4_common.c
|
||
|
|
@@ -2188,13 +2188,18 @@ static char *ext4fs_read_symlink(struct ext2fs_node *node)
|
||
|
|
struct ext2fs_node *diro = node;
|
||
|
|
int status;
|
||
|
|
loff_t actread;
|
||
|
|
+ size_t alloc_size;
|
||
|
|
|
||
|
|
if (!diro->inode_read) {
|
||
|
|
status = ext4fs_read_inode(diro->data, diro->ino, &diro->inode);
|
||
|
|
if (status == 0)
|
||
|
|
return NULL;
|
||
|
|
}
|
||
|
|
- symlink = zalloc(le32_to_cpu(diro->inode.size) + 1);
|
||
|
|
+
|
||
|
|
+ if (__builtin_add_overflow(le32_to_cpu(diro->inode.size), 1, &alloc_size))
|
||
|
|
+ return NULL;
|
||
|
|
+
|
||
|
|
+ symlink = zalloc(alloc_size);
|
||
|
|
if (!symlink)
|
||
|
|
return NULL;
|
||
|
|
|
||
|
|
--
|
||
|
|
2.34.1
|
||
|
|
|