Hi Jincheng, jc.w...@gmail.com wrote on Wed, 8 Jun 2022 11:37:13 +0800:
> To be honest, I don't have experience.... > > Reference to the article " > https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf" > , I tried to do some work. > > 1. checkpatch (√) > 2. no new compile warnings (√) > 3. if bug fix, verify the bug is fixed (√) > I tried some vul-samples, and the patch solved them well. > 4. if new feature, feature matches documentation (×) > I try some normal samples, and there is a bug. The dir name or > filename loses a byte. You can use the attachment to check it. > I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to > create the squashfs sample. What we are asking for is just you replying plain text to this thread with this line: "Tested-by: <you> <youraddress>" This "tag" will automatically be picked-up by the tools used by the maintainers when applying the patch, to trace who did what. > > > ```before patch > => ls host 0 > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 11 hello > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 1 file(s), 0 dir(s) > ``` > > > ```after patch > => ls host 0 > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 11 hell > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > > 1 file(s), 0 dir(s) > ``` > > > > > > > Tom Rini <tr...@konsulko.com> 于2022年6月7日周二 21:43写道: > > > On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote: > > > > > It works well, thanks for your work. > > > > Can you please provide a Tested-by? Thanks! > > > > > > > > > > > Miquel Raynal <miquel.ray...@bootlin.com> 于2022年6月3日周五 23:26写道: > > > > > > > > Following Jincheng's report, an out-of-band write leading to arbitrary > > > > code execution is possible because on one side the squashfs logic > > > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > > > > accepts directory names up to 255 bytes long. > > > > > > > > Prevent such an exploit from happening by capping directory name sizes > > > > to 255. Use a define for this purpose so that developers can link the > > > > limitation to its source and eventually kill it some day by dynamically > > > > allocating this array (if ever desired). > > > > > > > > Link: > > https://lore.kernel.org/all/CALO=dhfb+yboxxvr5kcsk0ifdg+e7ywko4-e+72kjbcs8jb...@mail.gmail.com > > > > > > Reported-by: Jincheng Wang <jc.w...@gmail.com> > > > > Signed-off-by: Miquel Raynal <miquel.ray...@bootlin.com> > > > > --- > > > > > > > > Hello Jincheng, can you please give this fix a try? > > > > > > > > Thanks! > > > > Miquèl > > > > > > > > fs/squashfs/sqfs.c | 8 +++++--- > > > > include/fs.h | 4 +++- > > > > 2 files changed, 8 insertions(+), 4 deletions(-) > > > > > > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > > > > index b4484fa17f5..ee6ac8b3e4d 100644 > > > > --- a/fs/squashfs/sqfs.c > > > > +++ b/fs/squashfs/sqfs.c > > > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > > struct fs_dirent **dentp) > > > > int i_number, offset = 0, ret; > > > > struct fs_dirent *dent; > > > > unsigned char *ipos; > > > > + u16 name_size; > > > > > > > > dirs = (struct squashfs_dir_stream *)fs_dirs; > > > > if (!dirs->size) { > > > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > > struct fs_dirent **dentp) > > > > return -SQFS_STOP_READDIR; > > > > } > > > > > > > > - /* Set entry name */ > > > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size > > + 1); > > > > - dent->name[dirs->entry->name_size + 1] = '\0'; > > > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a > > U-Boot limitation) */ > > > > + name_size = min_t(u16, dirs->entry->name_size, > > FS_DIRENT_NAME_LEN - 1); > > > > + strncpy(dent->name, dirs->entry->name, name_size); > > > > + dent->name[name_size] = '\0'; > > > > > > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > > > > dirs->entry_count--; > > > > diff --git a/include/fs.h b/include/fs.h > > > > index b43f16a692f..2195dc172ec 100644 > > > > --- a/include/fs.h > > > > +++ b/include/fs.h > > > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, > > loff_t offset, loff_t len, > > > > #define FS_DT_REG 8 /* regular file */ > > > > #define FS_DT_LNK 10 /* symbolic link */ > > > > > > > > +#define FS_DIRENT_NAME_LEN 256 > > > > + > > > > /** > > > > * struct fs_dirent - directory entry > > > > * > > > > @@ -194,7 +196,7 @@ struct fs_dirent { > > > > /** change_time: time of last modification */ > > > > struct rtc_time change_time; > > > > /** name: file name */ > > > > - char name[256]; > > > > + char name[FS_DIRENT_NAME_LEN]; > > > > }; > > > > > > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs > > layer */ > > > > -- > > > > 2.34.1 > > > > > > > > -- > > Tom > > Thanks, Miquèl