Received: by 10.223.185.116 with SMTP id b49csp1061339wrg; Fri, 23 Feb 2018 11:12:21 -0800 (PST) X-Google-Smtp-Source: AH8x2273bYvpc3RXOAG9c5Sks8p0+IsPaSywyFeZfzcjQsNw8maCZf0pziaMpy1hIUHymV/LTgS2 X-Received: by 2002:a17:902:e85:: with SMTP id 5-v6mr2645991plx.208.1519413140964; Fri, 23 Feb 2018 11:12:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519413140; cv=none; d=google.com; s=arc-20160816; b=LP+/T5wzMnj/v1K+65AsEhhLYR0PCqX0Qmbez7R+xFvOr9TgWgzfgwHrWgQzSS5C/L ZXD6Eox7lcMCF6GrXO6fYk5LnZWqOdsqPm2cKpmPGv9t0IzDMoEPCY2Fy0XLlbdjKQeg lYJ7lw87Rz4KhtzMbC1golcuee0+tv1kREnRg0edl9rghUgc7Esn9FzeIQP5T6gigMwb M6fWphxGbAzZt7lk7xT+oPDNxB8RSsJZDnVz6bdRry/XEk2R20g7kNCXrZsNbouCfSxE 6suQGAlhG8IJqEZnmOLy2L8Qdi1OtVlItykwtRFWJDJsqWPWXJSi0xWjHl1I0UlaEYnb G28g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=y05b7ngYxTauyRKzGcnIYkuwle+xCKWUWUfnbdfkNFQ=; b=KBemaaJ8PJfmyi5/3R4SUKmJ0scgGrt23MfN1AsrIRnq06ffpTT8+NHaN+HEoSiBGW R3jVwDBiCNJtxI43aou+YKGBQDLAqImpZUuN9Bg6cVBhcCzvH1H6qRmVyP8lKgqYblfv w8Mnl2dpSNpJEVUZstITkBXSUrCf/AdUKpe1e5cp0leCOxhM/QXVPoX5BK3BtAQldXbw 41y4im63ES5ewb2CeEr9KMFYNlWB+9dFO+cqvaZhlv8KTf6yGRvcPBJKRC4C7sbVuck7 /b3T/ep+CVqZaExkuox20AHAVfCvuYzUP12xHtMeVzoCyOvzWQtRKaR3Vg/PeiDSf0sA IA3g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m123si1844239pgm.698.2018.02.23.11.12.06; Fri, 23 Feb 2018 11:12:20 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935726AbeBWTLb (ORCPT + 99 others); Fri, 23 Feb 2018 14:11:31 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:49080 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935627AbeBWS4g (ORCPT ); Fri, 23 Feb 2018 13:56:36 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 90DFA1225; Fri, 23 Feb 2018 18:56:32 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikolay Borisov , David Sterba , Sasha Levin Subject: [PATCH 4.14 120/159] btrfs: Fix possible off-by-one in btrfs_search_path_in_tree Date: Fri, 23 Feb 2018 19:27:08 +0100 Message-Id: <20180223170757.806340242@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nikolay Borisov [ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ] The name char array passed to btrfs_search_path_in_tree is of size BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes are in the range of [0, 4079]. Currently the code uses the define but this represents an off-by-one. Implications: Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be written to extra space, not some padding that could be provided by the allocator. btrfs-progs store the arguments on stack, but kernel does own copy of the ioctl buffer and the off-by-one overwrite does not affect userspace, but the ending 0 might be lost. Kernel ioctl buffer is allocated dynamically so we're overwriting somebody else's memory, and the ioctl is privileged if args.objectid is not 256. Which is in most cases, but resolving a subvolume stored in another directory will trigger that path. Before this patch the buffer was one byte larger, but then the -1 was not added. Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls") Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba [ added implications ] Signed-off-by: David Sterba Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2221,7 +2221,7 @@ static noinline int btrfs_search_path_in if (!path) return -ENOMEM; - ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX]; + ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1]; key.objectid = tree_id; key.type = BTRFS_ROOT_ITEM_KEY;