Skip to main content

Browse the archive

https://github.com/torvalds/linux
27 March 2024, 02:37:15 UTC
Revision 961b33c244e5ba1543ae26270a1ba29f29c2db83 authored by Kees Cook on 03 August 2018, 19:52:58 UTC, committed by Kees Cook on 04 August 2018, 14:53:46 UTC 
jfs: Fix usercopy whitelist for inline inode data
 
Bart Massey reported what turned out to be a usercopy whitelist false
positive in JFS when symlink contents exceeded 128 bytes. The inline
inode data (i_inline) is actually designed to overflow into the "extended
area" following it (i_inline_ea) when needed. So the whitelist needed to
be expanded to include both i_inline and i_inline_ea (the whole size
of which is calculated internally using IDATASIZE, 256, instead of
sizeof(i_inline), 128).

$ cd /mnt/jfs
$ touch $(perl -e 'print "B" x 250')
$ ln -s B* b
$ ls -l >/dev/null

[  249.436410] Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLUB object 'jfs_ip' (offset 616, size 250)!

Reported-by: Bart Massey <bart.massey@gmail.com>
Fixes: 8d2704d382a9 ("jfs: Define usercopy region in jfs_ip slab cache")
Cc: Dave Kleikamp <shaggy@kernel.org>
Cc: jfs-discussion@lists.sourceforge.net
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
1 parent 7daf201
History
Tip revision: 961b33c244e5ba1543ae26270a1ba29f29c2db83 authored by Kees Cook on 03 August 2018, 19:52:58 UTC
jfs: Fix usercopy whitelist for inline inode data
Tip revision: 961b33c
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 12.8 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 9.3 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.3 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 321 bytes
MAINTAINERS -rw-r--r-- 449.0 KB
Makefile -rw-r--r-- 58.3 KB
README -rw-r--r-- 800 bytes

README

back to top