On Sun, Jul 1, 2018 at 2:20 PM, Richard Weinberger <[email protected]> wrote: > Check whether the size is within bounds before using it. > If the size is not correct, abort and dump the bad data node. > > Cc: Kees Cook <[email protected]> > Cc: Silvio Cesare <[email protected]> > Cc: [email protected] > Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system") > Reported-by: Silvio Cesare <[email protected]> > Signed-off-by: Richard Weinberger <[email protected]>
Reviewed-by: Kees Cook <[email protected]> -Kees > --- > fs/ubifs/journal.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c > index da8afdfccaa6..eea12d25a58b 100644 > --- a/fs/ubifs/journal.c > +++ b/fs/ubifs/journal.c > @@ -1387,7 +1387,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const > struct inode *inode, > else if (err) > goto out_free; > else { > - if (le32_to_cpu(dn->size) <= dlen) > + int dn_len = le32_to_cpu(dn->size); > + > + if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { > + ubifs_err(c, "bad data node (block %u, inode > %lu)", > + blk, inode->i_ino); > + ubifs_dump_node(c, dn); > + goto out_free; > + } > + > + if (dn_len <= dlen) > dlen = 0; /* Nothing to do */ > else { > err = truncate_data_node(c, inode, blk, dn, > &dlen); > -- > 2.18.0 > -- Kees Cook Pixel Security
