Bug 200401
| Summary: | Another buffer overrun in ext4_xattr_set_entry() when operating a corrupted ext4 image | ||
|---|---|---|---|
| Product: | File System | Reporter: | Wen Xu (wen.xu) |
| Component: | ext4 | Assignee: | fs_ext4 (fs_ext4) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | CC: | tytso, wen.xu |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.18 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
The (compressed) crafted image which causes crash
poc.c |
||
|
Description
Wen Xu
2018-07-03 23:41:05 UTC
Created attachment 277157 [details]
poc.c
Here's an even simpler repro: # mkdir mnt # mount -t ext4 final.img mnt # touch mnt/foo <crash> This is another case of "we're trying to expand the inode's extra i_size". Interestingly, e2fsck does *not* report the file system as corrupted. The abnormality of the file system is found here: % debugfs /tmp/poc-200401.img debugfs 1.44.3 (10-July-2018) debugfs: idump -x foo magic = ea020000, length = 96, value_start =4 offset = 4 (0004), name_len = 4, name_index = 7 value_offset = 0 (0004), value_inum = 0, value_size = 0 name = data offset = 24 (0030), name_len = 30, name_index = 0 value_offset = 0 (0004), value_inum = 0, value_size = 0 name = ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ last entry found at offset 72 (0110) The problem is that name_len is 30, but the name contains a NUL character, which the xattr code is not expecting, and fails to handle correctly. The simple fix is to add the sanity check, and refuse to deal with an xattr entry with an embedded NUL in the name. The fix for this is here: http://patchwork.ozlabs.org/patch/951358/ |