summaryrefslogtreecommitdiff
path: root/arch/mips/netlogic/common/Makefile
diff options
context:
space:
mode:
authorJann Horn <jannh@google.com>2018-08-22 07:59:37 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-08-24 14:07:17 +0300
commitc3139458db1fdd5a13dff38ac8dd99ac0dc75ac9 (patch)
treea47f6d489acbbe8daca602e6499e7d20868bcbc7 /arch/mips/netlogic/common/Makefile
parent9a63bbbf78cc9e346f563b8d17371d31fddf25c5 (diff)
downloadlinux-c3139458db1fdd5a13dff38ac8dd99ac0dc75ac9.tar.xz
reiserfs: fix broken xattr handling (heap corruption, bad retval)
commit a13f085d111e90469faf2d9965eb39b11c114d7e upstream. This fixes the following issues: - When a buffer size is supplied to reiserfs_listxattr() such that each individual name fits, but the concatenation of all names doesn't fit, reiserfs_listxattr() overflows the supplied buffer. This leads to a kernel heap overflow (verified using KASAN) followed by an out-of-bounds usercopy and is therefore a security bug. - When a buffer size is supplied to reiserfs_listxattr() such that a name doesn't fit, -ERANGE should be returned. But reiserfs instead just truncates the list of names; I have verified that if the only xattr on a file has a longer name than the supplied buffer length, listxattr() incorrectly returns zero. With my patch applied, -ERANGE is returned in both cases and the memory corruption doesn't happen anymore. Credit for making me clean this code up a bit goes to Al Viro, who pointed out that the ->actor calling convention is suboptimal and should be changed. Link: http://lkml.kernel.org/r/20180802151539.5373-1-jannh@google.com Fixes: 48b32a3553a5 ("reiserfs: use generic xattr handlers") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Jeff Mahoney <jeffm@suse.com> Cc: Eric Biggers <ebiggers@google.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/mips/netlogic/common/Makefile')
0 files changed, 0 insertions, 0 deletions