From: Greg Kroah-Hartman Date: Mon, 29 Aug 2022 07:33:34 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.10.140~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=16f0a7dcfc1bcbf33a6614dd622cd53f6dd0709c;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch loop-check-for-overflow-while-configuring-loop.patch --- diff --git a/queue-4.14/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch b/queue-4.14/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch new file mode 100644 index 00000000000..bf924d6e561 --- /dev/null +++ b/queue-4.14/btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch @@ -0,0 +1,60 @@ +From b51111271b0352aa596c5ae8faf06939e91b3b68 Mon Sep 17 00:00:00 2001 +From: Goldwyn Rodrigues +Date: Tue, 16 Aug 2022 16:42:56 -0500 +Subject: btrfs: check if root is readonly while setting security xattr + +From: Goldwyn Rodrigues + +commit b51111271b0352aa596c5ae8faf06939e91b3b68 upstream. + +For a filesystem which has btrfs read-only property set to true, all +write operations including xattr should be denied. However, security +xattr can still be changed even if btrfs ro property is true. + +This happens because xattr_permission() does not have any restrictions +on security.*, system.* and in some cases trusted.* from VFS and +the decision is left to the underlying filesystem. See comments in +xattr_permission() for more details. + +This patch checks if the root is read-only before performing the set +xattr operation. + +Testcase: + + DEV=/dev/vdb + MNT=/mnt + + mkfs.btrfs -f $DEV + mount $DEV $MNT + echo "file one" > $MNT/f1 + + setfattr -n "security.one" -v 2 $MNT/f1 + btrfs property set /mnt ro true + + setfattr -n "security.one" -v 1 $MNT/f1 + + umount $MNT + +CC: stable@vger.kernel.org # 4.9+ +Reviewed-by: Qu Wenruo +Reviewed-by: Filipe Manana +Signed-off-by: Goldwyn Rodrigues +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -378,6 +378,9 @@ static int btrfs_xattr_handler_get(const + struct dentry *unused, struct inode *inode, + const char *name, void *buffer, size_t size) + { ++ if (btrfs_root_readonly(BTRFS_I(inode)->root)) ++ return -EROFS; ++ + name = xattr_full_name(handler, name); + return __btrfs_getxattr(inode, name, buffer, size); + } diff --git a/queue-4.14/loop-check-for-overflow-while-configuring-loop.patch b/queue-4.14/loop-check-for-overflow-while-configuring-loop.patch new file mode 100644 index 00000000000..09cb4bfb484 --- /dev/null +++ b/queue-4.14/loop-check-for-overflow-while-configuring-loop.patch @@ -0,0 +1,59 @@ +From c490a0b5a4f36da3918181a8acdc6991d967c5f3 Mon Sep 17 00:00:00 2001 +From: Siddh Raman Pant +Date: Tue, 23 Aug 2022 21:38:10 +0530 +Subject: loop: Check for overflow while configuring loop + +From: Siddh Raman Pant + +commit c490a0b5a4f36da3918181a8acdc6991d967c5f3 upstream. + +The userspace can configure a loop using an ioctl call, wherein +a configuration of type loop_config is passed (see lo_ioctl()'s +case on line 1550 of drivers/block/loop.c). This proceeds to call +loop_configure() which in turn calls loop_set_status_from_info() +(see line 1050 of loop.c), passing &config->info which is of type +loop_info64*. This function then sets the appropriate values, like +the offset. + +loop_device has lo_offset of type loff_t (see line 52 of loop.c), +which is typdef-chained to long long, whereas loop_info64 has +lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). + +The function directly copies offset from info to the device as +follows (See line 980 of loop.c): + lo->lo_offset = info->lo_offset; + +This results in an overflow, which triggers a warning in iomap_iter() +due to a call to iomap_iter_done() which has: + WARN_ON_ONCE(iter->iomap.offset > iter->pos); + +Thus, check for negative value during loop_set_status_from_info(). + +Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e + +Reported-and-tested-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org +Reviewed-by: Matthew Wilcox (Oracle) +Signed-off-by: Siddh Raman Pant +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220823160810.181275-1-code@siddh.me +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/loop.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1212,6 +1212,11 @@ loop_get_status(struct loop_device *lo, + info->lo_number = lo->lo_number; + info->lo_offset = lo->lo_offset; + info->lo_sizelimit = lo->lo_sizelimit; ++ ++ /* loff_t vars have been assigned __u64 */ ++ if (lo->lo_offset < 0 || lo->lo_sizelimit < 0) ++ return -EOVERFLOW; ++ + info->lo_flags = lo->lo_flags; + memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE); + memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE); diff --git a/queue-4.14/series b/queue-4.14/series index fa5ddc2c6f1..2291918b7e2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -18,3 +18,5 @@ net-fix-a-data-race-around-netdev_budget.patch net-fix-a-data-race-around-netdev_budget_usecs.patch net-fix-a-data-race-around-sysctl_somaxconn.patch ixgbe-stop-resetting-systime-in-ixgbe_ptp_start_cycl.patch +btrfs-check-if-root-is-readonly-while-setting-security-xattr.patch +loop-check-for-overflow-while-configuring-loop.patch