shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 11:26:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: fsverity: explicitly check for buffer overflow in build_merkle_tree()

Browse Source 
The new Merkle tree construction algorithm is a bit fragile in that it
may overflow the 'root_hash' array if the tree actually generated does
not match the calculated tree parameters.

This should never happen unless there is a filesystem bug that allows
the file size to change despite deny_write_access(), or a bug in the
Merkle tree logic itself.  Regardless, it's fairly easy to check for
buffer overflow here, so let's do so.

This is a robustness improvement only; this case is not currently known
to be reachable.  I've added a Fixes tag anyway, since I recommend that
this be included in kernels that have the mentioned commit.

Fixes: 56124d6c87 ("fsverity: support enabling with tree block size < PAGE_SIZE")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230328041505.110162-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
(cherry picked from commit 39049b69ec)
Change-Id: I248fd8686a806f0099bed1ac83d52362af3e194e
This commit is contained in:
Eric Biggers
2023-03-27 21:15:05 -07:00
committed by Todd Kjos
parent 711f5d5bfe
commit d5feaf8163
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fs/verity/enable.c
View File

@@ -14,6 +14,7 @@
struct block_buffer { struct block_buffer {
u32 filled; u32 filled;
bool is_root_hash;
u8 *data; u8 *data;
}; };
@@ -25,6 +26,14 @@ static int hash_one_block(struct inode *inode,
struct block_buffer *next = cur + 1; struct block_buffer *next = cur + 1;
int err; int err;
/*
* Safety check to prevent a buffer overflow in case of a filesystem bug
* that allows the file size to change despite deny_write_access(), or a
* bug in the Merkle tree logic itself
*/
if (WARN_ON_ONCE(next->is_root_hash && next->filled != 0))
return -EINVAL;
/* Zero-pad the block if it's shorter than the block size. */ /* Zero-pad the block if it's shorter than the block size. */
memset(&cur->data[cur->filled], 0, params->block_size - cur->filled); memset(&cur->data[cur->filled], 0, params->block_size - cur->filled);
@@ -98,6 +107,7 @@ static int build_merkle_tree(struct file *filp,
} }
} }
buffers[num_levels].data = root_hash; buffers[num_levels].data = root_hash;
buffers[num_levels].is_root_hash = true;
BUILD_BUG_ON(sizeof(level_offset) != sizeof(params->level_start)); BUILD_BUG_ON(sizeof(level_offset) != sizeof(params->level_start));
memcpy(level_offset, params->level_start, sizeof(level_offset)); memcpy(level_offset, params->level_start, sizeof(level_offset));