• Dr. David Alan Gilbert's avatar
    jfs: Fix fortify moan in symlink · ebe06036
    Dr. David Alan Gilbert authored
    JFS has in jfs_incore.h:
    
          /* _inline may overflow into _inline_ea when needed */
          /* _inline_ea may overlay the last part of
           * file._xtroot if maxentry = XTROOTINITSLOT
           */
          union {
            struct {
              /* 128: inline symlink */
              unchar _inline[128];
              /* 128: inline extended attr */
              unchar _inline_ea[128];
            };
            unchar _inline_all[256];
    
    and currently the symlink code copies into _inline;
    if this is larger than 128 bytes it triggers a fortify warning of the
    form:
    
      memcpy: detected field-spanning write (size 132) of single field
         "ip->i_link" at fs/jfs/namei.c:950 (size 18446744073709551615)
    
    when it's actually OK.
    
    Copy it into _inline_all instead.
    
    Reported-by: syzbot+5fc38b2ddbbca7f5c680@syzkaller.appspotmail.com
    Signed-off-by: default avatarDr. David Alan Gilbert <linux@treblig.org>
    Reviewed-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
    ebe06036
namei.c 36.7 KB