From patchwork Fri Jun 3 15:26:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Miquel Raynal X-Patchwork-Id: 1638772 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=gm1 header.b=Ov+2doty; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4LF6F80mcwz9s0r for ; Sat, 4 Jun 2022 01:27:07 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 0042083F63; Fri, 3 Jun 2022 17:27:01 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.b="Ov+2doty"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 9CCB783E60; Fri, 3 Jun 2022 17:26:59 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [217.70.183.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 871BD84197 for ; Fri, 3 Jun 2022 17:26:55 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=miquel.raynal@bootlin.com Received: (Authenticated sender: miquel.raynal@bootlin.com) by mail.gandi.net (Postfix) with ESMTPSA id 4E8642000C; Fri, 3 Jun 2022 15:26:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1654270015; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JltmIMhzJOqbfT881X9YEoCBCxkeuZjOtJllEYE6hB4=; b=Ov+2dotyH/qQv2kW7vLgDtUOhfyIoESx/vWEmmQoM/BKp3PdjnZEshWo45gbfBWUQ7rlX+ Nz2NARC5aSUhah7Z9cuYU7x9fQwhOxCJ9iurgB5MRDonpri5Dwmywzc+HFmIkmEHuDzH+c IYJcXbn3KMvxqLp1nJgrBZD9AnlPWLrNEKnFLh0dkldVKj0i4HkahU3FrMnjDbhkjlBz+T MsTikvDlpp7yNoo3a90LGPkYTmXR0eakgLxr3DMr5ZMsttoZBmpMKAbuEX13jP494yQ8YU 1fdc499ROwOaxgxgAsdnZfg4Z98mVfdf27UvAzYCQHOc06D5bJlp4wH/ZkNYGg== From: Miquel Raynal To: Thomas Petazzoni Cc: Joao Marcos Costa , u-boot@lists.denx.de, Miquel Raynal , Jincheng Wang Subject: [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution Date: Fri, 3 Jun 2022 17:26:53 +0200 Message-Id: <20220603152653.629591-1-miquel.raynal@bootlin.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang Signed-off-by: Miquel Raynal --- Hello Jincheng, can you please give this fix a try? Thanks! Miquèl fs/squashfs/sqfs.c | 8 +++++--- include/fs.h | 4 +++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index b4484fa17f5..ee6ac8b3e4d 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) int i_number, offset = 0, ret; struct fs_dirent *dent; unsigned char *ipos; + u16 name_size; dirs = (struct squashfs_dir_stream *)fs_dirs; if (!dirs->size) { @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) return -SQFS_STOP_READDIR; } - /* Set entry name */ - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); - dent->name[dirs->entry->name_size + 1] = '\0'; + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */ + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1); + strncpy(dent->name, dirs->entry->name, name_size); + dent->name[name_size] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */ +#define FS_DIRENT_NAME_LEN 256 + /** * struct fs_dirent - directory entry * @@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */ - char name[256]; + char name[FS_DIRENT_NAME_LEN]; }; /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */