github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fsverity: Be more careful with return value of ->get_verity_descriptor()

Browse Source 
If fsverity_operations::get_verity_descriptor() returns that the verity
descriptor has 0 size, then a zero-size buffer is allocated to hold it,
and it's called again with bufsize=0.

But bufsize=0 is a special case that says to return the actual size.  If
in the meantime the filesystem has decided that the size is some
actually valid size, it will return that size, and then
validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash.

Of course, for the filesystem to misbehave in that strange way, it
generally would require direct writes to the block device.

Regardless, fsverity_get_descriptor() might as well guard against it.
Make it do so.  Specifically, validate that the first call to
->get_verity_descriptor() returns at least the minimum descriptor size,
and validate that the second call returns the same size as the first.

Fixes: fd2d1acfca ("fs-verity: add the hook for file ->open()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261025203831.120095-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
This commit is contained in:
Eric Biggers 2026-10-25 13:38:31 -07:00
parent 1acb4fd2d0
commit 8f8faec82a
1 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
fs/verity/open.c
View File

@ -270,12 +270,6 @@ static bool validate_fsverity_descriptor(struct inode *inode,
const struct fsverity_descriptor *desc,
size_t desc_size)
{
if (desc_size < sizeof(*desc)) {
fsverity_err(inode, "Unrecognized descriptor size: %zu bytes",
desc_size);
return false;
}
if (desc->version != 1) {
fsverity_err(inode, "Unrecognized descriptor version: %u",
desc->version);
@ -314,31 +308,37 @@ static bool validate_fsverity_descriptor(struct inode *inode,
int fsverity_get_descriptor(struct inode *inode,
struct fsverity_descriptor **desc_ret)
{
int res;
int size, res;
struct fsverity_descriptor *desc;
res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
if (res < 0) {
fsverity_err(inode,
"Error %d getting verity descriptor size", res);
return res;
size = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0);
if (size < 0) {
fsverity_err(inode, "Error %d getting verity descriptor size",
size);
return size;
}
if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
fsverity_err(inode, "Verity descriptor is too large (%d bytes)",
res);
if (size < sizeof(*desc) || size > FS_VERITY_MAX_DESCRIPTOR_SIZE) {
fsverity_err(inode,
"Verity descriptor has invalid size (%d bytes)",
size);
return -EMSGSIZE;
}
desc = kmalloc(res, GFP_KERNEL);
desc = kmalloc(size, GFP_KERNEL);
if (!desc)
return -ENOMEM;
res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res);
res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, size);
if (res < 0) {
fsverity_err(inode, "Error %d reading verity descriptor", res);
kfree(desc);
return res;
}
if (!validate_fsverity_descriptor(inode, desc, res)) {
if (res != size) {
fsverity_err(inode, "Verity descriptor size changed (%d => %d)",
size, res);
kfree(desc);
return -EINVAL;
}
if (!validate_fsverity_descriptor(inode, desc, size)) {
kfree(desc);
return -EINVAL;
}