From 4fe6b95dbb296b9e24c5e00e264844b8b18cc83d Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Wed, 21 Feb 2024 12:10:45 +0800 Subject: [PATCH] f2fs: explicitly null-terminate the xattr list mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: 189530 CVE: CVE-2023-52436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e26b6d39270f5eab0087453d9b544189a38c8564 -------------------------------- When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. Signed-off-by: Eric Biggers Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Zizhi Wo --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 1858c66d871d..eef2b05fd7e1 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -718,6 +718,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; } error = write_all_xattrs(inode, new_hsize, base_addr, ipage); -- Gitee