Message ID | 20220603152653.629591-1-miquel.raynal@bootlin.com |
---|---|
State | Superseded |
Delegated to: | Tom Rini |
Headers | show |
Series | fs/squashfs: sqfs_read: Prevent arbitrary code execution | expand |
It works well, thanks for your work. Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道: > > Following Jincheng's report, an out-of-band write leading to arbitrary > code execution is possible because on one side the squashfs logic > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > accepts directory names up to 255 bytes long. > > Prevent such an exploit from happening by capping directory name sizes > to 255. Use a define for this purpose so that developers can link the > limitation to its source and eventually kill it some day by dynamically > allocating this array (if ever desired). > > Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com > Reported-by: Jincheng Wang <jc.w4ng@gmail.com> > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> > --- > > Hello Jincheng, can you please give this fix a try? > > Thanks! > Miquèl > > fs/squashfs/sqfs.c | 8 +++++--- > include/fs.h | 4 +++- > 2 files changed, 8 insertions(+), 4 deletions(-) > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > index b4484fa17f5..ee6ac8b3e4d 100644 > --- a/fs/squashfs/sqfs.c > +++ b/fs/squashfs/sqfs.c > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) > int i_number, offset = 0, ret; > struct fs_dirent *dent; > unsigned char *ipos; > + u16 name_size; > > dirs = (struct squashfs_dir_stream *)fs_dirs; > if (!dirs->size) { > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) > return -SQFS_STOP_READDIR; > } > > - /* Set entry name */ > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); > - dent->name[dirs->entry->name_size + 1] = '\0'; > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ > + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1); > + strncpy(dent->name, dirs->entry->name, name_size); > + dent->name[name_size] = '\0'; > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > dirs->entry_count--; > diff --git a/include/fs.h b/include/fs.h > index b43f16a692f..2195dc172ec 100644 > --- a/include/fs.h > +++ b/include/fs.h > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, > #define FS_DT_REG 8 /* regular file */ > #define FS_DT_LNK 10 /* symbolic link */ > > +#define FS_DIRENT_NAME_LEN 256 > + > /** > * struct fs_dirent - directory entry > * > @@ -194,7 +196,7 @@ struct fs_dirent { > /** change_time: time of last modification */ > struct rtc_time change_time; > /** name: file name */ > - char name[256]; > + char name[FS_DIRENT_NAME_LEN]; > }; > > /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */ > -- > 2.34.1 >
On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote: > It works well, thanks for your work. Can you please provide a Tested-by? Thanks! > > > Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道: > > > > Following Jincheng's report, an out-of-band write leading to arbitrary > > code execution is possible because on one side the squashfs logic > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > > accepts directory names up to 255 bytes long. > > > > Prevent such an exploit from happening by capping directory name sizes > > to 255. Use a define for this purpose so that developers can link the > > limitation to its source and eventually kill it some day by dynamically > > allocating this array (if ever desired). > > > > Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com > > Reported-by: Jincheng Wang <jc.w4ng@gmail.com> > > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> > > --- > > > > Hello Jincheng, can you please give this fix a try? > > > > Thanks! > > Miquèl > > > > fs/squashfs/sqfs.c | 8 +++++--- > > include/fs.h | 4 +++- > > 2 files changed, 8 insertions(+), 4 deletions(-) > > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > > index b4484fa17f5..ee6ac8b3e4d 100644 > > --- a/fs/squashfs/sqfs.c > > +++ b/fs/squashfs/sqfs.c > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) > > int i_number, offset = 0, ret; > > struct fs_dirent *dent; > > unsigned char *ipos; > > + u16 name_size; > > > > dirs = (struct squashfs_dir_stream *)fs_dirs; > > if (!dirs->size) { > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) > > return -SQFS_STOP_READDIR; > > } > > > > - /* Set entry name */ > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); > > - dent->name[dirs->entry->name_size + 1] = '\0'; > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ > > + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1); > > + strncpy(dent->name, dirs->entry->name, name_size); > > + dent->name[name_size] = '\0'; > > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > > dirs->entry_count--; > > diff --git a/include/fs.h b/include/fs.h > > index b43f16a692f..2195dc172ec 100644 > > --- a/include/fs.h > > +++ b/include/fs.h > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, > > #define FS_DT_REG 8 /* regular file */ > > #define FS_DT_LNK 10 /* symbolic link */ > > > > +#define FS_DIRENT_NAME_LEN 256 > > + > > /** > > * struct fs_dirent - directory entry > > * > > @@ -194,7 +196,7 @@ struct fs_dirent { > > /** change_time: time of last modification */ > > struct rtc_time change_time; > > /** name: file name */ > > - char name[256]; > > + char name[FS_DIRENT_NAME_LEN]; > > }; > > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */ > > -- > > 2.34.1 > >
To be honest, I don't have experience.... Reference to the article " https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf" , I tried to do some work. 1. checkpatch (√) 2. no new compile warnings (√) 3. if bug fix, verify the bug is fixed (√) I tried some vul-samples, and the patch solved them well. 4. if new feature, feature matches documentation (×) I try some normal samples, and there is a bug. The dir name or filename loses a byte. You can use the attachment to check it. I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to create the squashfs sample. ```before patch => ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hello BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 1 file(s), 0 dir(s) ``` ```after patch => ls host 0 BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 11 hell BTRFS: superblock end 69632 is larger than device size 4096 BTRFS: superblock end 69632 is larger than device size 4096 1 file(s), 0 dir(s) ``` Tom Rini <trini@konsulko.com> 于2022年6月7日周二 21:43写道: > On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote: > > > It works well, thanks for your work. > > Can you please provide a Tested-by? Thanks! > > > > > > > Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道: > > > > > > Following Jincheng's report, an out-of-band write leading to arbitrary > > > code execution is possible because on one side the squashfs logic > > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > > > accepts directory names up to 255 bytes long. > > > > > > Prevent such an exploit from happening by capping directory name sizes > > > to 255. Use a define for this purpose so that developers can link the > > > limitation to its source and eventually kill it some day by dynamically > > > allocating this array (if ever desired). > > > > > > Link: > https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com > > > Reported-by: Jincheng Wang <jc.w4ng@gmail.com> > > > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> > > > --- > > > > > > Hello Jincheng, can you please give this fix a try? > > > > > > Thanks! > > > Miquèl > > > > > > fs/squashfs/sqfs.c | 8 +++++--- > > > include/fs.h | 4 +++- > > > 2 files changed, 8 insertions(+), 4 deletions(-) > > > > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > > > index b4484fa17f5..ee6ac8b3e4d 100644 > > > --- a/fs/squashfs/sqfs.c > > > +++ b/fs/squashfs/sqfs.c > > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > struct fs_dirent **dentp) > > > int i_number, offset = 0, ret; > > > struct fs_dirent *dent; > > > unsigned char *ipos; > > > + u16 name_size; > > > > > > dirs = (struct squashfs_dir_stream *)fs_dirs; > > > if (!dirs->size) { > > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > struct fs_dirent **dentp) > > > return -SQFS_STOP_READDIR; > > > } > > > > > > - /* Set entry name */ > > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size > + 1); > > > - dent->name[dirs->entry->name_size + 1] = '\0'; > > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a > U-Boot limitation) */ > > > + name_size = min_t(u16, dirs->entry->name_size, > FS_DIRENT_NAME_LEN - 1); > > > + strncpy(dent->name, dirs->entry->name, name_size); > > > + dent->name[name_size] = '\0'; > > > > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > > > dirs->entry_count--; > > > diff --git a/include/fs.h b/include/fs.h > > > index b43f16a692f..2195dc172ec 100644 > > > --- a/include/fs.h > > > +++ b/include/fs.h > > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, > loff_t offset, loff_t len, > > > #define FS_DT_REG 8 /* regular file */ > > > #define FS_DT_LNK 10 /* symbolic link */ > > > > > > +#define FS_DIRENT_NAME_LEN 256 > > > + > > > /** > > > * struct fs_dirent - directory entry > > > * > > > @@ -194,7 +196,7 @@ struct fs_dirent { > > > /** change_time: time of last modification */ > > > struct rtc_time change_time; > > > /** name: file name */ > > > - char name[256]; > > > + char name[FS_DIRENT_NAME_LEN]; > > > }; > > > > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs > layer */ > > > -- > > > 2.34.1 > > > > > -- > Tom >
Hi Jincheng, jc.w4ng@gmail.com wrote on Wed, 8 Jun 2022 11:37:13 +0800: > To be honest, I don't have experience.... > > Reference to the article " > https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf" > , I tried to do some work. > > 1. checkpatch (√) > 2. no new compile warnings (√) > 3. if bug fix, verify the bug is fixed (√) > I tried some vul-samples, and the patch solved them well. > 4. if new feature, feature matches documentation (×) > I try some normal samples, and there is a bug. The dir name or > filename loses a byte. You can use the attachment to check it. > I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to > create the squashfs sample. What we are asking for is just you replying plain text to this thread with this line: "Tested-by: <you> <youraddress>" This "tag" will automatically be picked-up by the tools used by the maintainers when applying the patch, to trace who did what. > > > ```before patch > => ls host 0 > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 11 hello > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 1 file(s), 0 dir(s) > ``` > > > ```after patch > => ls host 0 > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > 11 hell > BTRFS: superblock end 69632 is larger than device size 4096 > BTRFS: superblock end 69632 is larger than device size 4096 > > 1 file(s), 0 dir(s) > ``` > > > > > > > Tom Rini <trini@konsulko.com> 于2022年6月7日周二 21:43写道: > > > On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote: > > > > > It works well, thanks for your work. > > > > Can you please provide a Tested-by? Thanks! > > > > > > > > > > > Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道: > > > > > > > > Following Jincheng's report, an out-of-band write leading to arbitrary > > > > code execution is possible because on one side the squashfs logic > > > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > > > > accepts directory names up to 255 bytes long. > > > > > > > > Prevent such an exploit from happening by capping directory name sizes > > > > to 255. Use a define for this purpose so that developers can link the > > > > limitation to its source and eventually kill it some day by dynamically > > > > allocating this array (if ever desired). > > > > > > > > Link: > > https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com > > > > Reported-by: Jincheng Wang <jc.w4ng@gmail.com> > > > > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> > > > > --- > > > > > > > > Hello Jincheng, can you please give this fix a try? > > > > > > > > Thanks! > > > > Miquèl > > > > > > > > fs/squashfs/sqfs.c | 8 +++++--- > > > > include/fs.h | 4 +++- > > > > 2 files changed, 8 insertions(+), 4 deletions(-) > > > > > > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > > > > index b4484fa17f5..ee6ac8b3e4d 100644 > > > > --- a/fs/squashfs/sqfs.c > > > > +++ b/fs/squashfs/sqfs.c > > > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > > struct fs_dirent **dentp) > > > > int i_number, offset = 0, ret; > > > > struct fs_dirent *dent; > > > > unsigned char *ipos; > > > > + u16 name_size; > > > > > > > > dirs = (struct squashfs_dir_stream *)fs_dirs; > > > > if (!dirs->size) { > > > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > > struct fs_dirent **dentp) > > > > return -SQFS_STOP_READDIR; > > > > } > > > > > > > > - /* Set entry name */ > > > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size > > + 1); > > > > - dent->name[dirs->entry->name_size + 1] = '\0'; > > > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a > > U-Boot limitation) */ > > > > + name_size = min_t(u16, dirs->entry->name_size, > > FS_DIRENT_NAME_LEN - 1); > > > > + strncpy(dent->name, dirs->entry->name, name_size); > > > > + dent->name[name_size] = '\0'; > > > > > > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > > > > dirs->entry_count--; > > > > diff --git a/include/fs.h b/include/fs.h > > > > index b43f16a692f..2195dc172ec 100644 > > > > --- a/include/fs.h > > > > +++ b/include/fs.h > > > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, > > loff_t offset, loff_t len, > > > > #define FS_DT_REG 8 /* regular file */ > > > > #define FS_DT_LNK 10 /* symbolic link */ > > > > > > > > +#define FS_DIRENT_NAME_LEN 256 > > > > + > > > > /** > > > > * struct fs_dirent - directory entry > > > > * > > > > @@ -194,7 +196,7 @@ struct fs_dirent { > > > > /** change_time: time of last modification */ > > > > struct rtc_time change_time; > > > > /** name: file name */ > > > > - char name[256]; > > > > + char name[FS_DIRENT_NAME_LEN]; > > > > }; > > > > > > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs > > layer */ > > > > -- > > > > 2.34.1 > > > > > > > > -- > > Tom > > Thanks, Miquèl
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos; + u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) { @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; } - /* Set entry name */ - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); - dent->name[dirs->entry->name_size + 1] = '\0'; + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1); + strncpy(dent->name, dirs->entry->name, name_size); + dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */ +#define FS_DIRENT_NAME_LEN 256 + /** * struct fs_dirent - directory entry * @@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */ - char name[256]; + char name[FS_DIRENT_NAME_LEN]; }; /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang <jc.w4ng@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> --- Hello Jincheng, can you please give this fix a try? Thanks! Miquèl fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-)