Commit a13f085d authored by Jann Horn's avatar Jann Horn Committed by Linus Torvalds
Browse files

reiserfs: fix broken xattr handling (heap corruption, bad retval)

This fixes the following issues:

- When a buffer size is supplied to reiserfs_listxattr() such that each
  individual name fits, but the concatenation of all names doesn't fit,
  reiserfs_listxattr() overflows the supplied buffer.  This leads to a
  kernel heap overflow (verified using KASAN) followed by an out-of-bounds
  usercopy and is therefore a security bug.

- When a buffer size is supplied to reiserfs_listxattr() such that a
  name doesn't fit, -ERANGE should be returned.  But reiserfs instead just
  truncates the list of names; I have verified that if the only xattr on a
  file has a longer name than the supplied buffer length, listxattr()
  incorrectly returns zero.

With my patch applied, -ERANGE is returned in both cases and the memory
corruption doesn't happen anymore.

Credit for making me clean this code up a bit goes to Al Viro, who pointed
out that the ->actor calling convention is suboptimal and should be

Fixes: 48b32a35

 ("reiserfs: use generic xattr handlers")
Signed-off-by: default avatarJann Horn <>
Acked-by: default avatarJeff Mahoney <>
Cc: Eric Biggers <>
Cc: Al Viro <>
Cc: <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 8b73ce6a
...@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name, ...@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name,
return 0; return 0;
size = namelen + 1; size = namelen + 1;
if (b->buf) { if (b->buf) {
if (size > b->size) if (b->pos + size > b->size) {
b->pos = -ERANGE;
return -ERANGE; return -ERANGE;
memcpy(b->buf + b->pos, name, namelen); memcpy(b->buf + b->pos, name, namelen);
b->buf[b->pos + namelen] = 0; b->buf[b->pos + namelen] = 0;
} }
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment