Eric Biggers ce3fd194fc ext4: limit xattr size to INT_MAX ... ext4 isn't validating the sizes of xattrs where the value of the xattr is stored in an external inode. This is problematic because ->e_value_size is a u32, but ext4_xattr_get() returns an int. A very large size is misinterpreted as an error code, which ext4_get_acl() translates into a bogus ERR_PTR() for which IS_ERR() returns false, causing a crash. Fix this by validating that all xattrs are <= INT_MAX bytes. This issue has been assigned CVE-2018-1095. https://bugzilla.kernel.org/show_bug.cgi?id=199185 https://bugzilla.redhat.com/show_bug.cgi?id=1560793 Reported-by: Wen Xu <wen.xu@gatech.edu> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@vger.kernel.org Fixes: e50e5129f3 ("ext4: xattr-in-inode support")		2018-03-29 14:31:42 -04:00
..
acl.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
acl.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
balloc.c	ext4: add validity checks for bitmap block numbers	2018-03-26 23:54:10 -04:00
bitmap.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
block_validity.c	ext4: use 'sbi' instead of 'EXT4_SB(sb)'	2018-01-11 13:17:49 -05:00
dir.c	iversion: Rename make inode_cmp_iversion{+raw} to inode_eq_iversion{+raw}	2018-02-01 08:15:25 -05:00
ext4_extents.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
ext4_jbd2.c	ext4: shutdown should not prevent get_write_access	2018-02-18 22:07:36 -05:00
ext4_jbd2.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
ext4.h	ext4: remove EXT4_STATE_DIOREAD_LOCK flag	2018-03-22 11:52:10 -04:00
extents_status.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
extents_status.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
extents.c	ext4: fix comments in ext4_swap_extents()	2018-03-26 01:44:03 -04:00
file.c	ext4: fix ENOSPC handling in DAX page fault handler	2018-01-07 16:41:01 -05:00
fsmap.c	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
fsmap.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
fsync.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hash.c	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
ialloc.c	ext4: add validity checks for bitmap block numbers	2018-03-26 23:54:10 -04:00
indirect.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
inline.c	iversion.h related cleanup for v4.16	2018-02-07 14:25:22 -08:00
inode.c	ext4: use generic_writepages instead of __writepage/write_cache_pages	2018-03-26 01:32:50 -04:00
ioctl.c	ext4: remove EXT4_STATE_DIOREAD_LOCK flag	2018-03-22 11:52:10 -04:00
Kconfig	fs/*/Kconfig: drop links to 404-compliant http://acl.bestbits.at	2018-01-01 12:45:37 -07:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mballoc.c	ext4: use 'sbi' instead of 'EXT4_SB(sb)'	2018-01-11 13:17:49 -05:00
mballoc.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
migrate.c	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
mmp.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
move_extent.c	ext4: remove EXT4_STATE_DIOREAD_LOCK flag	2018-03-22 11:52:10 -04:00
namei.c	Refactor support for encrypted symlinks to move common code to fscrypt.	2018-02-04 10:43:12 -08:00
page-io.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
readpage.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
resize.c	ext4: use 'sbi' instead of 'EXT4_SB(sb)'	2018-01-11 13:17:49 -05:00
super.c	ext4: don't complain about incorrect features when probing	2018-03-22 11:59:00 -04:00
symlink.c	ext4: switch to fscrypt_get_symlink()	2018-01-11 22:10:40 -05:00
sysfs.c	ext4: create ext4_kset dynamically	2018-01-11 15:34:04 -05:00
truncate.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
xattr_security.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xattr_trusted.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xattr_user.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xattr.c	ext4: limit xattr size to INT_MAX	2018-03-29 14:31:42 -04:00
xattr.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00