[linux] 01/01: get_rock_ridge_filename(): handle malformed NM entries (CVE-2016-4913)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch wheezy-security
in repository linux.

commit 9444ccccb2ca0c59d2ae5c7d7965bb085565693c
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu May 19 22:41:31 2016 +0200

    get_rock_ridge_filename(): handle malformed NM entries (CVE-2016-4913)
---
 debian/changelog                                   |  3 ++
 ...idge_filename-handle-malformed-NM-entries.patch | 63 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 67 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 8afe688..7ceef93 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -170,6 +170,9 @@ linux (3.2.80-1) UNRELEASED; urgency=medium
     - aufs: implement new f_op->setfl()
     - fs: Fix ABI change for aufs F_SETFL fix
 
+  [ Salvatore Bonaccorso ]
+  * get_rock_ridge_filename(): handle malformed NM entries (CVE-2016-4913)
+
  -- Ben Hutchings <ben at decadent.org.uk>  Fri, 01 Apr 2016 02:11:16 +0100
 
 linux (3.2.78-1) wheezy; urgency=medium
diff --git a/debian/patches/bugfix/all/get_rock_ridge_filename-handle-malformed-NM-entries.patch b/debian/patches/bugfix/all/get_rock_ridge_filename-handle-malformed-NM-entries.patch
new file mode 100644
index 0000000..063a5a5
--- /dev/null
+++ b/debian/patches/bugfix/all/get_rock_ridge_filename-handle-malformed-NM-entries.patch
@@ -0,0 +1,63 @@
+From: Al Viro <viro at zeniv.linux.org.uk>
+Date: Thu, 5 May 2016 16:25:35 -0400
+Subject: get_rock_ridge_filename(): handle malformed NM entries
+Origin: https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
+
+Payloads of NM entries are not supposed to contain NUL.  When we run
+into such, only the part prior to the first NUL goes into the
+concatenation (i.e. the directory entry name being encoded by a bunch
+of NM entries).  We do stop when the amount collected so far + the
+claimed amount in the current NM entry exceed 254.  So far, so good,
+but what we return as the total length is the sum of *claimed*
+sizes, not the actual amount collected.  And that can grow pretty
+large - not unlimited, since you'd need to put CE entries in
+between to be able to get more than the maximum that could be
+contained in one isofs directory entry / continuation chunk and
+we are stop once we'd encountered 32 CEs, but you can get about 8Kb
+easily.  And that's what will be passed to readdir callback as the
+name length.  8Kb __copy_to_user() from a buffer allocated by
+__get_free_page()
+
+Cc: stable at vger.kernel.org # 0.98pl6+ (yes, really)
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+---
+ fs/isofs/rock.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index 5384ceb..98b3eb7 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -203,6 +203,8 @@ int get_rock_ridge_filename(struct iso_directory_record *de,
+ 	int retnamlen = 0;
+ 	int truncate = 0;
+ 	int ret = 0;
++	char *p;
++	int len;
+ 
+ 	if (!ISOFS_SB(inode->i_sb)->s_rock)
+ 		return 0;
+@@ -267,12 +269,17 @@ repeat:
+ 					rr->u.NM.flags);
+ 				break;
+ 			}
+-			if ((strlen(retname) + rr->len - 5) >= 254) {
++			len = rr->len - 5;
++			if (retnamlen + len >= 254) {
+ 				truncate = 1;
+ 				break;
+ 			}
+-			strncat(retname, rr->u.NM.name, rr->len - 5);
+-			retnamlen += rr->len - 5;
++			p = memchr(rr->u.NM.name, '\0', len);
++			if (unlikely(p))
++				len = p - rr->u.NM.name;
++			memcpy(retname + retnamlen, rr->u.NM.name, len);
++			retnamlen += len;
++			retname[retnamlen] = '\0';
+ 			break;
+ 		case SIG('R', 'E'):
+ 			kfree(rs.buffer);
+-- 
+2.8.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 464b29d..cd105d6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1176,3 +1176,4 @@ bugfix/all/revert-ax25-add-link-layer-header-validation-functio.patch
 bugfix/all/revert-net-validate-variable-length-ll-headers.patch
 debian/revert-net-ipv6-add-sysctl-option-accept_ra_min_hop_limit.patch
 debian/fs-fix-abi-change-for-aufs-f_setfl-fix.patch
+bugfix/all/get_rock_ridge_filename-handle-malformed-NM-entries.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git