linux/fs/overlayfs
Dan Carpenter 9aafc1b018 ovl: potential crash in ovl_fid_to_fh()
The "buflen" value comes from the user and there is a potential that it
could be zero.  In do_handle_to_path() we know that "handle->handle_bytes"
is non-zero and we do:

	handle_dwords = handle->handle_bytes >> 2;

So values 1-3 become zero.  Then in ovl_fh_to_dentry() we do:

	int len = fh_len << 2;

So now len is in the "0,4-128" range and a multiple of 4.  But if
"buflen" is zero it will try to copy negative bytes when we do the
memcpy in ovl_fid_to_fh().

	memcpy(&fh->fb, fid, buflen - OVL_FH_WIRE_OFFSET);

And that will lead to a crash.  Thanks to Amir Goldstein for his help
with this patch.

Fixes: cbe7fba8ed ("ovl: make sure that real fid is 32bit aligned in memory")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Cc: <stable@vger.kernel.org> # v5.5
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2020-05-13 11:10:57 +02:00
..
copy_up.c ovl: ignore failure to copy up unknown xattrs 2020-03-17 15:04:22 +01:00
dir.c ovl: fix WARN_ON nlink drop to zero 2020-03-27 16:51:02 +01:00
export.c ovl: potential crash in ovl_fid_to_fh() 2020-05-13 11:10:57 +02:00
file.c ovl: fix lockdep warning for async write 2020-03-13 15:53:06 +01:00
inode.c ovl: clear ATTR_OPEN from attr->ia_valid 2020-04-30 11:52:07 +02:00
Kconfig ovl: fix some xino configurations 2020-03-13 15:53:06 +01:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
namei.c ovl: allow remote upper 2020-03-17 15:04:22 +01:00
overlayfs.h ovl: enable xino automatically in more cases 2020-03-27 16:51:02 +01:00
ovl_entry.h ovl: use a private non-persistent ino pool 2020-03-27 16:51:02 +01:00
readdir.c ovl: enable xino automatically in more cases 2020-03-27 16:51:02 +01:00
super.c ovl: enable xino automatically in more cases 2020-03-27 16:51:02 +01:00
util.c ovl: allow remote upper 2020-03-17 15:04:22 +01:00