releases/4.4.154/ext4-check-for-nul-characters-in-extended-attribute-s-name.patch

   1 From 7d95178c77014dbd8dce36ee40bbbc5e6c121ff5 Mon Sep 17 00:00:00 2001
   2 From: Theodore Ts'o <tytso@mit.edu>
   3 Date: Wed, 1 Aug 2018 12:36:52 -0400
   4 Subject: ext4: check for NUL characters in extended attribute's name
   5
   6 From: Theodore Ts'o <tytso@mit.edu>
   7
   8 commit 7d95178c77014dbd8dce36ee40bbbc5e6c121ff5 upstream.
   9
  10 Extended attribute names are defined to be NUL-terminated, so the name
  11 must not contain a NUL character.  This is important because there are
  12 places when remove extended attribute, the code uses strlen to
  13 determine the length of the entry.  That should probably be fixed at
  14 some point, but code is currently really messy, so the simplest fix
  15 for now is to simply validate that the extended attributes are sane.
  16
  17 https://bugzilla.kernel.org/show_bug.cgi?id=200401
  18
  19 Reported-by: Wen Xu <wen.xu@gatech.edu>
  20 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  21 Cc: stable@vger.kernel.org
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  fs/ext4/xattr.c |    2 ++
  26  1 file changed, 2 insertions(+)
  27
  28 --- a/fs/ext4/xattr.c
  29 +++ b/fs/ext4/xattr.c
  30 @@ -197,6 +197,8 @@ ext4_xattr_check_names(struct ext4_xattr
  31                 struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e);
  32                 if ((void *)next >= end)
  33                         return -EFSCORRUPTED;
  34 +               if (strnlen(e->e_name, e->e_name_len) != e->e_name_len)
  35 +                       return -EFSCORRUPTED;
  36                 e = next;
  37         }
  38