From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1372483-1517179762-2-107525467266189320 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org', XOriginatingCountry='US' X-Spam-charsets: plain='iso-8859-1' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517179761; b=PDp1T++SmZoTDjg9UEjBtbLwqDBr1wcD+3tDKNufH8QiI9u /yjcruKGorP9jB4/aTKgJPO0HkmHO1bYi6VDZQ9YMw05aP7kp8sHDpocvAgePxm4 zaA5I9AyRZnKppUHc3C9tfbqmq1ALCFYzZIxS2VkFeyhldJAlDwkrxk3LFsTzKOy 4cxhDfSloYbwodPC57k6w2FisUFiIKK0En6qJu+NN9J9zPEr4sJK+EKPKxKhrIXO h7HUXefRQsQChTOp2vfK0JjAiRRamPMSi61Dw2nfmT57+/Yv21y/OeBLG8cBW7sv blGoX8AUiFdRTm2zyCosjYGbdZJEARdmKOchIsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :references:in-reply-to:content-type:content-transfer-encoding :mime-version:sender:list-id; s=arctest; t=1517179761; bh=X3qoD8 p1s+U4FsXMjeibECjpIVSmu1oxqlZ+a20JDwQ=; b=vK/VeWe1/1MngsKvEwDTM7 KmxGSbbhZZh3Ch/JwMfEpnhwrfrrz4riXDbswlT27gQa4gX11bMhmlUjSnipMRas oYw+aCg/ML8DORihso4fHj2nT0yBPHPIEtltHufxTRe20AWe2c5n7ydKAIek8LSG qMgAwzrGWfCt48uo93qSOcqKIgYaV3nYpCRANf9Aq7xeI4e566V4QXxBXNnmng4k 8fqANdeuWgutjdOHhsdIQCGRXclCXUv06jdc+PBTe+H67pxpllBEcK/oiDpNGXoe YccbVTL6+7hPvyxyK/fmw0eJbQt00ACJ7YL9C/p71Nc0a6ThdelaEEDvo8YY7zYg == ARC-Authentication-Results: i=1; mx6.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=Rx2y8ZHO x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Authentication-Results: mx6.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=microsoft.com header.i=@microsoft.com header.b=Rx2y8ZHO x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=selector1; dmarc=pass (p=reject,has-list-id=yes,d=none) header.from=microsoft.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=microsoft.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932276AbeA1WtT (ORCPT ); Sun, 28 Jan 2018 17:49:19 -0500 Received: from mail-dm3nam03on0120.outbound.protection.outlook.com ([104.47.41.120]:15392 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753740AbeA1W3H (ORCPT ); Sun, 28 Jan 2018 17:29:07 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Nikolay Borisov , David Sterba , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 27/49] btrfs: Fix possible off-by-one in btrfs_search_path_in_tree Thread-Topic: [PATCH AUTOSEL for 4.9 27/49] btrfs: Fix possible off-by-one in btrfs_search_path_in_tree Thread-Index: AQHTmIc8YedvbHh9gUuPLFRX7xUbfA== Date: Sun, 28 Jan 2018 22:27:53 +0000 Message-ID: <20180128222727.22404-27-alexander.levin@microsoft.com> References: <20180128222727.22404-1-alexander.levin@microsoft.com> In-Reply-To: <20180128222727.22404-1-alexander.levin@microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [52.168.54.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;MW2PR2101MB1097;7:xxNJPz7EcZyKbsyIh2EBp6lgjBjHUchzTP6OvJC9A7U+PIkYeqo3G3O/RFldH3PlJq9yRiRPLf3OOXUNy9+XQWkHPGtWjyLUD2SGZGRSS6YJRJcVTR85ZckXzzXspi8q6nG5EAB6Z5d5fr6zpZ0vOxaBe1TP1pNvSZkoEYBI89RwhtlWZHHNcrQVx0ngzISSTzJ7zKFPx38cF8Vya80+SKQ9q0pyfJ26WwLZIrBYEoGsUirJA3AvcLMhqEboF6aE x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: d1d6ded2-3e2e-43ec-b5b2-08d5669e87e5 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(3008032)(2017052603307)(7193020);SRVR:MW2PR2101MB1097; x-ms-traffictypediagnostic: MW2PR2101MB1097: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alexander.Levin@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(89211679590171); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(61425038)(6040501)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(3231101)(944501161)(6055026)(61426038)(61427038)(6041288)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123558120)(20161123562045)(20161123560045)(6072148)(201708071742011);SRVR:MW2PR2101MB1097;BCL:0;PCL:0;RULEID:;SRVR:MW2PR2101MB1097; x-forefront-prvs: 05669A7924 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(366004)(39380400002)(39860400002)(396003)(376002)(199004)(189003)(72206003)(14454004)(3280700002)(106356001)(4326008)(478600001)(10290500003)(76176011)(102836004)(3660700001)(59450400001)(25786009)(6506007)(105586002)(316002)(6486002)(97736004)(22452003)(186003)(99286004)(110136005)(54906003)(107886003)(26005)(86362001)(8676002)(81156014)(2906002)(1076002)(81166006)(68736007)(3846002)(6116002)(305945005)(7736002)(36756003)(86612001)(10090500001)(6512007)(2950100002)(66066001)(5660300001)(53936002)(6666003)(8936002)(6436002)(2501003)(2900100001)(5250100002)(22906009)(217873001);DIR:OUT;SFP:1102;SCL:1;SRVR:MW2PR2101MB1097;H:MW2PR2101MB1034.namprd21.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; x-microsoft-antispam-message-info: TixcPG8NhVS40bCVGvPJ9Sf6HIX6IQxfjQQ/m8am31A06XStcb3SBdKKWebOv09SB/a+kAewEGzkNB5DMyoabg== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d1d6ded2-3e2e-43ec-b5b2-08d5669e87e5 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jan 2018 22:27:53.5686 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR2101MB1097 Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Nikolay Borisov [ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ] The name char array passed to btrfs_search_path_in_tree is of size BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes are in the range of [0, 4079]. Currently the code uses the define but this represents an off-by-one. Implications: Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be written to extra space, not some padding that could be provided by the allocator. btrfs-progs store the arguments on stack, but kernel does own copy of the ioctl buffer and the off-by-one overwrite does not affect userspace, but the ending 0 might be lost. Kernel ioctl buffer is allocated dynamically so we're overwriting somebody else's memory, and the ioctl is privileged if args.objectid is not 256. Which is in most cases, but resolving a subvolume stored in another directory will trigger that path. Before this patch the buffer was one byte larger, but then the -1 was not added. Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls") Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba [ added implications ] Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/btrfs/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 0fe346c4bd28..d3dd631432eb 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2244,7 +2244,7 @@ static noinline int btrfs_search_path_in_tree(struct = btrfs_fs_info *info, if (!path) return -ENOMEM; =20 - ptr =3D &name[BTRFS_INO_LOOKUP_PATH_MAX]; + ptr =3D &name[BTRFS_INO_LOOKUP_PATH_MAX - 1]; =20 key.objectid =3D tree_id; key.type =3D BTRFS_ROOT_ITEM_KEY; --=20 2.11.0