Re: [PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-13 Thread Jeff Mahoney
On 8/13/18 2:04 PM, Jann Horn wrote: > On Mon, Aug 13, 2018 at 7:42 PM Will Deacon wrote: >> >> Hi Jann, >> >> On Fri, Aug 10, 2018 at 05:19:38AM +0200, Jann Horn wrote: >>> On Thu, Aug 2, 2018 at 5:16 PM Jann Horn wrote: This fixes the following issues: - When a buffer size

Re: [PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-13 Thread Jeff Mahoney
On 8/2/18 11:15 AM, Jann Horn wrote: > This fixes the following issues: > > - When a buffer size is supplied to reiserfs_listxattr() such that each >individual name fits, but the concatenation of all names doesn't >fit, reiserfs_listxattr() overflows the supplied buffer. This leads to >

Re: [PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-13 Thread Jann Horn
On Mon, Aug 13, 2018 at 7:42 PM Will Deacon wrote: > > Hi Jann, > > On Fri, Aug 10, 2018 at 05:19:38AM +0200, Jann Horn wrote: > > On Thu, Aug 2, 2018 at 5:16 PM Jann Horn wrote: > > > > > > This fixes the following issues: > > > > > > - When a buffer size is supplied to reiserfs_listxattr() suc

Re: [PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-13 Thread Will Deacon
Hi Jann, On Fri, Aug 10, 2018 at 05:19:38AM +0200, Jann Horn wrote: > On Thu, Aug 2, 2018 at 5:16 PM Jann Horn wrote: > > > > This fixes the following issues: > > > > - When a buffer size is supplied to reiserfs_listxattr() such that each > >individual name fits, but the concatenation of all

Re: [PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-09 Thread Jann Horn
On Thu, Aug 2, 2018 at 5:16 PM Jann Horn wrote: > > This fixes the following issues: > > - When a buffer size is supplied to reiserfs_listxattr() such that each >individual name fits, but the concatenation of all names doesn't >fit, reiserfs_listxattr() overflows the supplied buffer. This

[PATCH] reiserfs: fix broken xattr handling (heap corruption, bad retval)

2018-08-02 Thread Jann Horn
This fixes the following issues: - When a buffer size is supplied to reiserfs_listxattr() such that each individual name fits, but the concatenation of all names doesn't fit, reiserfs_listxattr() overflows the supplied buffer. This leads to a kernel heap overflow (verified using KASAN) f