| Message ID | 689c4eda-dd80-c1bd-843f-1b485bfddc5a@redhat.com (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | [V2] xfs: fix boundary test in xfs_attr_shortform_verify | expand |
On Wed, Aug 26, 2020 at 11:19:54AM -0500, Eric Sandeen wrote: > The boundary test for the fixed-offset parts of xfs_attr_sf_entry in > xfs_attr_shortform_verify is off by one, because the variable array > at the end is defined as nameval[1] not nameval[]. > Hence we need to subtract 1 from the calculation. > > This can be shown by: > > # touch file > # setfattr -n root.a file > > and verifications will fail when it's written to disk. > > This only matters for a last attribute which has a single-byte name > and no value, otherwise the combination of namelen & valuelen will > push endp further out and this test won't fail. > > Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs") > Signed-off-by: Eric Sandeen <sandeen@redhat.com> Looks ok. From whom should I be expecting a test case? Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> --D > --- > > V2: Add whitespace and comments, tweak commit log. > > Note: as Darrick points out, this should be made consistent w/ the dir2 arrays > by making the nameval variable size array [] not [1], and then we can lose all > the -1 magic sprinkled around. At that time we should probably also make the > macros into proper functions, as was done for dir2. > > For now, this is just the least invasive fixup for the problem at hand. > > diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c > index 8623c815164a..383b08f2ac61 100644 > --- a/fs/xfs/libxfs/xfs_attr_leaf.c > +++ b/fs/xfs/libxfs/xfs_attr_leaf.c > @@ -1036,8 +1036,10 @@ xfs_attr_shortform_verify( > * struct xfs_attr_sf_entry has a variable length. > * Check the fixed-offset parts of the structure are > * within the data buffer. > + * xfs_attr_sf_entry is defined with a 1-byte variable > + * array at the end, so we must subtract that off. > */ > - if (((char *)sfep + sizeof(*sfep)) >= endp) > + if (((char *)sfep + sizeof(*sfep) - 1) >= endp) > return __this_address; > > /* Don't allow names with known bad length. */ >
On 8/26/20 11:44 AM, Darrick J. Wong wrote: > On Wed, Aug 26, 2020 at 11:19:54AM -0500, Eric Sandeen wrote: >> The boundary test for the fixed-offset parts of xfs_attr_sf_entry in >> xfs_attr_shortform_verify is off by one, because the variable array >> at the end is defined as nameval[1] not nameval[]. >> Hence we need to subtract 1 from the calculation. >> >> This can be shown by: >> >> # touch file >> # setfattr -n root.a file >> >> and verifications will fail when it's written to disk. >> >> This only matters for a last attribute which has a single-byte name >> and no value, otherwise the combination of namelen & valuelen will >> push endp further out and this test won't fail. >> >> Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs") >> Signed-off-by: Eric Sandeen <sandeen@redhat.com> > > Looks ok. thanks > From whom should I be expecting a test case? from me or a TBD delegate. Will follow up soon. -Eric > Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Looks good,
Reviewed-by: Christoph Hellwig <hch@lst.de>
Can you follow up with the struct definition fix ASAP?
On 8/27/20 3:12 AM, Christoph Hellwig wrote: > Looks good, > > Reviewed-by: Christoph Hellwig <hch@lst.de> > > Can you follow up with the struct definition fix ASAP? Working on delegating that task, yes. -Eric
> From whom should I be expecting a test case?
Hi,
I took the task, I hope it will be done soon - I'll do my best.
Pavel
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c index 8623c815164a..383b08f2ac61 100644 --- a/fs/xfs/libxfs/xfs_attr_leaf.c +++ b/fs/xfs/libxfs/xfs_attr_leaf.c @@ -1036,8 +1036,10 @@ xfs_attr_shortform_verify( * struct xfs_attr_sf_entry has a variable length. * Check the fixed-offset parts of the structure are * within the data buffer. + * xfs_attr_sf_entry is defined with a 1-byte variable + * array at the end, so we must subtract that off. */ - if (((char *)sfep + sizeof(*sfep)) >= endp) + if (((char *)sfep + sizeof(*sfep) - 1) >= endp) return __this_address; /* Don't allow names with known bad length. */
The boundary test for the fixed-offset parts of xfs_attr_sf_entry in xfs_attr_shortform_verify is off by one, because the variable array at the end is defined as nameval[1] not nameval[]. Hence we need to subtract 1 from the calculation. This can be shown by: # touch file # setfattr -n root.a file and verifications will fail when it's written to disk. This only matters for a last attribute which has a single-byte name and no value, otherwise the combination of namelen & valuelen will push endp further out and this test won't fail. Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs") Signed-off-by: Eric Sandeen <sandeen@redhat.com> --- V2: Add whitespace and comments, tweak commit log. Note: as Darrick points out, this should be made consistent w/ the dir2 arrays by making the nameval variable size array [] not [1], and then we can lose all the -1 magic sprinkled around. At that time we should probably also make the macros into proper functions, as was done for dir2. For now, this is just the least invasive fixup for the problem at hand.