[PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution

[Miquel Raynal]

Hi Jincheng,

jc.w4ng at gmail.com wrote on Wed, 8 Jun 2022 11:37:13 +0800:

> To be honest, I don't have experience....
> 
> Reference to the article "
> https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf"
> , I tried to do some work.
> 
> 1. checkpatch  (√)
> 2. no new compile warnings (√)
> 3. if bug fix, verify the bug is fixed (√)
>      I tried some vul-samples, and the patch solved them well.
> 4. if new feature, feature matches documentation (×)
>      I try some normal samples, and there is a bug. The dir name or
> filename loses a byte. You can use the attachment to check it.
>      I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to
> create the squashfs sample.

What we are asking for is just you replying plain text to this thread
with this line: "Tested-by: <you> <youraddress>"

This "tag" will automatically be picked-up by the tools used by the
maintainers when applying the patch, to trace who did what.

> 
> 
> ```before patch
> => ls host 0  
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
>        11   hello
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
> 1 file(s), 0 dir(s)
> ```
> 
> 
> ```after patch
> => ls host 0  
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
>        11   hell
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
> 
> 1 file(s), 0 dir(s)
>  ```
> 
> 
> 
> 
> 
> 
> Tom Rini <trini at konsulko.com> 于2022年6月7日周二 21:43写道：
> 
> > On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
> >  
> > > It works well, thanks for your work.  
> >
> > Can you please provide a Tested-by?  Thanks!
> >  
> > >
> > >
> > > Miquel Raynal <miquel.raynal at bootlin.com> 于2022年6月3日周五 23:26写道：  
> > > >
> > > > Following Jincheng's report, an out-of-band write leading to arbitrary
> > > > code execution is possible because on one side the squashfs logic
> > > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> > > > accepts directory names up to 255 bytes long.
> > > >
> > > > Prevent such an exploit from happening by capping directory name sizes
> > > > to 255. Use a define for this purpose so that developers can link the
> > > > limitation to its source and eventually kill it some day by dynamically
> > > > allocating this array (if ever desired).
> > > >
> > > > Link:  
> > https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com  
> > > > Reported-by: Jincheng Wang <jc.w4ng at gmail.com>
> > > > Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
> > > > ---
> > > >
> > > > Hello Jincheng, can you please give this fix a try?
> > > >
> > > > Thanks!
> > > > Miquèl
> > > >
> > > >  fs/squashfs/sqfs.c | 8 +++++---
> > > >  include/fs.h       | 4 +++-
> > > >  2 files changed, 8 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
> > > > index b4484fa17f5..ee6ac8b3e4d 100644
> > > > --- a/fs/squashfs/sqfs.c
> > > > +++ b/fs/squashfs/sqfs.c
> > > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,  
> > struct fs_dirent **dentp)  
> > > >         int i_number, offset = 0, ret;
> > > >         struct fs_dirent *dent;
> > > >         unsigned char *ipos;
> > > > +       u16 name_size;
> > > >
> > > >         dirs = (struct squashfs_dir_stream *)fs_dirs;
> > > >         if (!dirs->size) {
> > > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,  
> > struct fs_dirent **dentp)  
> > > >                 return -SQFS_STOP_READDIR;
> > > >         }
> > > >
> > > > -       /* Set entry name */
> > > > -       strncpy(dent->name, dirs->entry->name, dirs->entry->name_size  
> > + 1);  
> > > > -       dent->name[dirs->entry->name_size + 1] = '\0';
> > > > +       /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a  
> > U-Boot limitation) */  
> > > > +       name_size = min_t(u16, dirs->entry->name_size,  
> > FS_DIRENT_NAME_LEN - 1);  
> > > > +       strncpy(dent->name, dirs->entry->name, name_size);
> > > > +       dent->name[name_size] = '\0';
> > > >
> > > >         offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
> > > >         dirs->entry_count--;
> > > > diff --git a/include/fs.h b/include/fs.h
> > > > index b43f16a692f..2195dc172ec 100644
> > > > --- a/include/fs.h
> > > > +++ b/include/fs.h
> > > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr,  
> > loff_t offset, loff_t len,  
> > > >  #define FS_DT_REG  8         /* regular file */
> > > >  #define FS_DT_LNK  10        /* symbolic link */
> > > >
> > > > +#define FS_DIRENT_NAME_LEN 256
> > > > +
> > > >  /**
> > > >   * struct fs_dirent - directory entry
> > > >   *
> > > > @@ -194,7 +196,7 @@ struct fs_dirent {
> > > >         /** change_time:        time of last modification */
> > > >         struct rtc_time change_time;
> > > >         /** name:               file name */
> > > > -       char name[256];
> > > > +       char name[FS_DIRENT_NAME_LEN];
> > > >  };
> > > >
> > > >  /* Note: fs_dir_stream should be treated as opaque to the user of fs  
> > layer */  
> > > > --
> > > > 2.34.1
> > > >  
> >
> > --
> > Tom
> >  


Thanks,
Miquèl