[5.10,052/152] ext4: dont leak old mountpoint samples

Message ID	20210118113355.287099265@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Richard Weinberger <richard@nod.at>, Theodore Tso <tytso@mit.edu>, stable@kernel.org, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 052/152] ext4: dont leak old mountpoint samples Date: Mon, 18 Jan 2021 12:33:47 +0100 Message-Id: <20210118113355.287099265@linuxfoundation.org> In-Reply-To: <20210118113352.764293297@linuxfoundation.org> References: <20210118113352.764293297@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/152] btrfs: prevent NULL pointer dereference in extent_io_tree_panic [5.10,003/152] ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines [5.10,004/152] ALSA: doc: Fix reference to mixart.rst [5.10,005/152] ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395 [5.10,006/152] ASoC: dapm: remove widget from dirty list on free [5.10,007/152] x86/hyperv: check cpu mask after interrupt has been disabled [5.10,008/152] drm/amdgpu: add green_sardine device id (v2) [5.10,009/152] drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921) [5.10,010/152] Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel" [5.10,011/152] drm/amdgpu: add new device id for Renior [5.10,012/152] drm/i915: Allow the sysadmin to override security mitigations [5.10,013/152] drm/i915/gt: Limit VFE threads based on GT [5.10,014/152] drm/i915/backlight: fix CPU mode backlight takeover on LPT [5.10,015/152] drm/bridge: sii902x: Refactor init code into separate function [5.10,016/152] dt-bindings: display: sii902x: Add supply bindings [5.10,017/152] drm/bridge: sii902x: Enable I/O and core VCC supplies if present [5.10,018/152] tracing/kprobes: Do the notrace functions check without kprobes on ftrace [5.10,019/152] tools/bootconfig: Add tracing_on support to helper scripts [5.10,020/152] ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR [5.10,021/152] ext4: fix wrong list_splice in ext4_fc_cleanup [5.10,022/152] ext4: fix bug for rename with RENAME_WHITEOUT [5.10,023/152] cifs: check pointer before freeing [5.10,024/152] cifs: fix interrupted close commands [5.10,025/152] riscv: Drop a duplicated PAGE_KERNEL_EXEC [5.10,026/152] riscv: return -ENOSYS for syscall -1 [5.10,027/152] riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL [5.10,028/152] riscv: Fix KASAN memory mapping. [5.10,029/152] mips: fix Section mismatch in reference [5.10,030/152] mips: lib: uncached: fix non-standard usage of variable sp [5.10,031/152] MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB [5.10,032/152] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps [5.10,033/152] MIPS: relocatable: fix possible boot hangup with KASLR enabled [5.10,034/152] RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() [5.10,035/152] ACPI: scan: Harden acpi_device_add() against device ID overflows [5.10,036/152] xen/privcmd: allow fetching resource sizes [5.10,037/152] compiler.h: Raise minimum version of GCC to 5.1 for arm64 [5.10,038/152] mm/vmalloc.c: fix potential memory leak [5.10,039/152] mm/hugetlb: fix potential missing huge page size info [5.10,040/152] mm/process_vm_access.c: include compat.h [5.10,041/152] dm raid: fix discard limits for raid1 [5.10,042/152] dm snapshot: flush merged data before committing metadata [5.10,043/152] dm integrity: fix flush with external metadata device [5.10,044/152] dm integrity: fix the maximum number of arguments [5.10,045/152] dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq [5.10,046/152] dm crypt: do not wait for backlogged crypto request completion in softirq [5.10,047/152] dm crypt: do not call bio_endio() from the dm-crypt tasklet [5.10,048/152] dm crypt: defer decryption to a tasklet if interrupts disabled [5.10,049/152] stmmac: intel: change all EHL/TGL to auto detect phy addr [5.10,050/152] r8152: Add Lenovo Powered USB-C Travel Hub [5.10,051/152] btrfs: tree-checker: check if chunk item end overflows [5.10,052/152] ext4: dont leak old mountpoint samples [5.10,053/152] io_uring: dont take files/mm for a dead task [5.10,054/152] io_uring: drop mm and files after task_work_run [5.10,055/152] ARC: build: remove non-existing bootpImage from KBUILD_IMAGE [5.10,056/152] ARC: build: add uImage.lzma to the top-level target [5.10,057/152] ARC: build: add boot_targets to PHONY [5.10,058/152] ARC: build: move symlink creation to arch/arc/Makefile to avoid race [5.10,059/152] ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with defaults on xt875 [5.10,060/152] ath11k: fix crash caused by NULL rx_channel [5.10,061/152] netfilter: ipset: fixes possible oops in mtype_resize [5.10,062/152] ath11k: qmi: try to allocate a big block of DMA memory first [5.10,063/152] btrfs: fix async discard stall [5.10,064/152] btrfs: merge critical sections of discard lock in workfn [5.10,065/152] btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan [5.10,066/152] regulator: bd718x7: Add enable times [5.10,067/152] ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram [5.10,068/152] ARM: dts: ux500/golden: Set display max brightness [5.10,069/152] habanalabs: adjust pci controller init to new firmware [5.10,070/152] habanalabs/gaudi: retry loading TPC f/w on -EINTR [5.10,071/152] habanalabs: register to pci shutdown callback [5.10,072/152] staging: spmi: hisi-spmi-controller: Fix some error handling paths [5.10,073/152] spi: altera: fix return value for altera_spi_txrx() [5.10,074/152] habanalabs: Fix memleak in hl_device_reset [5.10,075/152] hwmon: (pwm-fan) Ensure that calculation doesnt discard big period values [5.10,076/152] lib/raid6: Let $(UNROLL) rules work with macOS userland [5.10,077/152] kconfig: remove kvmconfig and xenconfig shorthands [5.10,078/152] spi: fix the divide by 0 error when calculating xfer waiting time [5.10,079/152] io_uring: drop file refs after task cancel [5.10,080/152] bfq: Fix computation of shallow depth [5.10,081/152] arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC [5.10,082/152] misdn: dsp: select CONFIG_BITREVERSE [5.10,083/152] net: ethernet: fs_enet: Add missing MODULE_LICENSE [5.10,084/152] selftests: fix the return value for UDP GRO test [5.10,085/152] nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN [5.10,086/152] nvme: avoid possible double fetch in handling CQE [5.10,087/152] nvmet-rdma: Fix list_del corruption on queue establishment failure [5.10,088/152] drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer issue [5.10,089/152] drm/amdgpu: fix a GPU hang issue when remove device [5.10,090/152] drm/amd/pm: fix the failure when change power profile for renoir [5.10,091/152] drm/amdgpu: fix potential memory leak during navi12 deinitialization [5.10,092/152] usb: typec: Fix copy paste error for NVIDIA alt-mode description [5.10,093/152] iommu/vt-d: Fix lockdep splat in sva bind()/unbind() [5.10,094/152] ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI [5.10,095/152] drm/msm: Call msm_init_vram before binding the gpu [5.10,096/152] ARM: picoxcell: fix missing interrupt-parent properties [5.10,097/152] poll: fix performance regression due to out-of-line __put_user() [5.10,098/152] rcu-tasks: Move RCU-tasks initialization to before early_initcall() [5.10,099/152] bpf: Simplify task_file_seq_get_next() [5.10,100/152] bpf: Save correct stopping point in file seq iteration [5.10,101/152] x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling [5.10,102/152] cfg80211: select CONFIG_CRC32 [5.10,103/152] nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context [5.10,104/152] iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev [5.10,105/152] net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled [5.10,106/152] net/mlx5: Fix passing zero to PTR_ERR [5.10,107/152] net/mlx5: E-Switch, fix changing vf VLANID [5.10,108/152] blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED [5.10,109/152] mm: fix clear_refs_write locking [5.10,110/152] mm: dont play games with pinned pages in clear_page_refs [5.10,111/152] mm: dont put pinned pages into the swap cache [5.10,112/152] perf intel-pt: Fix CPU too large error [5.10,113/152] dump_common_audit_data(): fix racy accesses to ->d_name [5.10,114/152] ASoC: meson: axg-tdm-interface: fix loopback [5.10,115/152] ASoC: meson: axg-tdmin: fix axg skew offset [5.10,116/152] ASoC: Intel: fix error code cnl_set_dsp_D0() [5.10,117/152] nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY [5.10,118/152] nvme: dont intialize hwmon for discovery controllers [5.10,119/152] nvme-tcp: fix possible data corruption with bio merges [5.10,120/152] nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT [5.10,121/152] NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock [5.10,122/152] pNFS: We want return-on-close to complete when evicting the inode [5.10,123/152] pNFS: Mark layout for return if return-on-close was not sent [5.10,124/152] pNFS: Stricter ordering of layoutget and layoutreturn [5.10,125/152] NFS: Adjust fs_context error logging [5.10,126/152] NFS/pNFS: Dont call pnfs_free_bucket_lseg() before removing the request [5.10,127/152] NFS/pNFS: Dont leak DS commits in pnfs_generic_retry_commit() [5.10,128/152] NFS/pNFS: Fix a leak of the layout plh_outstanding counter [5.10,129/152] NFS: nfs_delegation_find_inode_server must first reference the superblock [5.10,130/152] NFS: nfs_igrab_and_active must first reference the superblock [5.10,131/152] scsi: ufs: Fix possible power drain during system suspend [5.10,132/152] ext4: fix superblock checksum failure when setting password salt [5.10,133/152] RDMA/restrack: Dont treat as an error allocation ID wrapping [5.10,134/152] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp [5.10,135/152] bnxt_en: Improve stats context resource accounting with RDMA driver loaded. [5.10,136/152] RDMA/mlx5: Fix wrong free of blue flame register on error [5.10,137/152] IB/mlx5: Fix error unwinding when set_has_smi_cap fails [5.10,138/152] umount(2): move the flag validity checks first [5.10,139/152] dm zoned: select CONFIG_CRC32 [5.10,140/152] drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no res... [5.10,141/152] drm/i915/icl: Fix initing the DSI DSC power refcount during HW readout [5.10,142/152] drm/i915/gt: Restore clear-residual mitigations for Ivybridge, Baytrail [5.10,143/152] mm, slub: consider rest of partial list if acquire_slab() fails [5.10,144/152] riscv: Trace irq on only interrupt is enabled [5.10,145/152] iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev() [5.10,146/152] net: sunrpc: interpret the return value of kstrtou32 correctly [5.10,147/152] selftests: netfilter: Pass family parameter "-f" to conntrack tool [5.10,148/152] dm: eliminate potential source of excessive kernel log noise [5.10,149/152] ALSA: fireface: Fix integer overflow in transmit_midi_msg() [5.10,150/152] ALSA: firewire-tascam: Fix integer overflow in midi_port_work() [5.10,151/152] netfilter: conntrack: fix reading nf_conntrack_buckets [5.10,152/152] netfilter: nf_nat: Fix memleak in nf_nat_init

Message ID

20210118113355.287099265@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Richard Weinberger <richard@nod.at>,
	Theodore Tso <tytso@mit.edu>, stable@kernel.org,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 052/152] ext4: dont leak old mountpoint samples
Date: Mon, 18 Jan 2021 12:33:47 +0100
Message-Id: <20210118113355.287099265@linuxfoundation.org>
In-Reply-To: <20210118113352.764293297@linuxfoundation.org>
References: <20210118113352.764293297@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman Jan. 18, 2021, 11:33 a.m. UTC

From: Theodore Ts'o <tytso@mit.edu>

[ Upstream commit 5a3b590d4b2db187faa6f06adc9a53d6199fb1f9 ]

When the first file is opened, ext4 samples the mountpoint of the
filesystem in 64 bytes of the super block.  It does so using
strlcpy(), this means that the remaining bytes in the super block
string buffer are untouched.  If the mount point before had a longer
path than the current one, it can be reconstructed.

Consider the case where the fs was mounted to "/media/johnjdeveloper"
and later to "/".  The super block buffer then contains
"/\x00edia/johnjdeveloper".

This case was seen in the wild and caused confusion how the name
of a developer ands up on the super block of a filesystem used
in production...

Fix this by using strncpy() instead of strlcpy().  The superblock
field is defined to be a fixed-size char array, and it is already
marked using __nonstring in fs/ext4/ext4.h.  The consumer of the field
in e2fsprogs already assumes that in the case of a 64+ byte mount
path, that s_last_mounted will not be NUL terminated.

Link: https://lore.kernel.org/r/X9ujIOJG/HqMr88R@mit.edu
Reported-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 3ed8c048fb12c..b692355b8c770 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -809,7 +809,7 @@  static int ext4_sample_last_mounted(struct super_block *sb,
 	err = ext4_journal_get_write_access(handle, sbi->s_sbh);
 	if (err)
 		goto out_journal;
-	strlcpy(sbi->s_es->s_last_mounted, cp,
+	strncpy(sbi->s_es->s_last_mounted, cp,
 		sizeof(sbi->s_es->s_last_mounted));
 	ext4_handle_dirty_super(handle, sb);
 out_journal:

[5.10,052/152] ext4: dont leak old mountpoint samples

Commit Message

Patch