ext4: avoid utf8_strncasecmp() with unstable name (2ce3ee93) · Commits · 戴 / test

If the dentry name passed to ->d_compare() fits in dentry::d_iname, then it may be concurrently modified by a rename. This can cause undefined behavior (possibly out-of-bounds memory accesses or crashes) in utf8_strncasecmp(), since fs/unicode/ isn't written to handle strings that may be concurrently modified. Fix this by first copying the filename to a stack buffer if needed. This way we get a stable snapshot of the filename. Fixes: ("ext4: Support case-insensitive file name lookups") Cc: <stable@vger.kernel.org> # v5.2+ Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Daniel Rosenberg <drosen@google.com> Cc: Gabriel Krisman Bertazi <krisman@collabora.co.uk> Signed-off-by:

Eric Biggers <ebiggers@google.com> Reviewed-by:

Andreas Dilger <adilger@dilger.ca> Link: https://lore.kernel.org/r/20200601200543.59417-1-ebiggers@kernel.org Signed-off-by:

Theodore Ts'o <tytso@mit.edu>

fs/ext4/dir.c

+16 −0

Original line number	Diff line number	Diff line
		@@ -675,6 +675,7 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len,
		struct qstr qstr = {.name = str, .len = len };
		const struct dentry *parent = READ_ONCE(dentry->d_parent);
		const struct inode *inode = READ_ONCE(parent->d_inode);
		char strbuf[DNAME_INLINE_LEN];

		if (!inode \|\| !IS_CASEFOLDED(inode) \|\|
		!EXT4_SB(inode->i_sb)->s_encoding) {
		@@ -683,6 +684,21 @@ static int ext4_d_compare(const struct dentry *dentry, unsigned int len,
		return memcmp(str, name->name, len);
		}

		/*
		* If the dentry name is stored in-line, then it may be concurrently
		* modified by a rename. If this happens, the VFS will eventually retry
		* the lookup, so it doesn't matter what ->d_compare() returns.
		* However, it's unsafe to call utf8_strncasecmp() with an unstable
		* string. Therefore, we have to copy the name into a temporary buffer.
		*/
		if (len <= DNAME_INLINE_LEN - 1) {
		memcpy(strbuf, str, len);
		strbuf[len] = 0;
		qstr.name = strbuf;
		/* prevent compiler from optimizing out the temporary buffer */
		barrier();
		}

		return ext4_ci_compare(inode, name, &qstr, false);
		}

Admin message