No description
Find a file
Jann Horn a13f085d11 reiserfs: fix broken xattr handling (heap corruption, bad retval)
This fixes the following issues:

- When a buffer size is supplied to reiserfs_listxattr() such that each
  individual name fits, but the concatenation of all names doesn't fit,
  reiserfs_listxattr() overflows the supplied buffer.  This leads to a
  kernel heap overflow (verified using KASAN) followed by an out-of-bounds
  usercopy and is therefore a security bug.

- When a buffer size is supplied to reiserfs_listxattr() such that a
  name doesn't fit, -ERANGE should be returned.  But reiserfs instead just
  truncates the list of names; I have verified that if the only xattr on a
  file has a longer name than the supplied buffer length, listxattr()
  incorrectly returns zero.

With my patch applied, -ERANGE is returned in both cases and the memory
corruption doesn't happen anymore.

Credit for making me clean this code up a bit goes to Al Viro, who pointed
out that the ->actor calling convention is suboptimal and should be
changed.

Link: http://lkml.kernel.org/r/20180802151539.5373-1-jannh@google.com
Fixes: 48b32a3553 ("reiserfs: use generic xattr handlers")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-08-22 10:52:50 -07:00
arch module: use relative references for __ksymtab entries 2018-08-22 10:52:47 -07:00
block
certs
crypto
Documentation kernel/hung_task.c: allow to set checking interval separately from timeout 2018-08-22 10:52:47 -07:00
drivers bcache: use routines from lib/crc64.c for CRC64 calculation 2018-08-22 10:52:48 -07:00
firmware
fs reiserfs: fix broken xattr handling (heap corruption, bad retval) 2018-08-22 10:52:50 -07:00
include autofs: add AUTOFS_EXP_FORCED flag 2018-08-22 10:52:49 -07:00
init init/main.c: log init process file name 2018-08-22 10:52:49 -07:00
ipc
kernel sched/wait: assert the wait_queue_head lock is held in __wake_up_common 2018-08-22 10:52:47 -07:00
lib lib/test_hexdump.c: fix failure on big endian cpu 2018-08-22 10:52:48 -07:00
LICENSES
mm bdi: use irqsave variant of refcount_dec_and_lock() 2018-08-22 10:52:46 -07:00
net The main things are support for cephx v2 authentication protocol and 2018-08-20 18:26:55 -07:00
samples
scripts checkpatch: DT bindings should be a separate patch 2018-08-22 10:52:49 -07:00
security init: allow initcall tables to be emitted using relative references 2018-08-22 10:52:47 -07:00
sound
tools proc: test /proc/thread-self symlink 2018-08-22 10:52:45 -07:00
usr
virt mm, oom: distinguish blockable mode for mmu notifiers 2018-08-22 10:52:44 -07:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS - New Drivers 2018-08-20 15:38:44 -07:00
Makefile Updates for v4.19: 2018-08-20 18:32:00 -07:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.