Re: [PATCH] fs/namespace: reject bufsize < sizeof(struct statmount) in prepare_kstatmount()

[Jan Kara]

On Sat 19-09-26 22:17:32, Hui Peng wrote:
> In prepare_kstatmount(), kstatmount.buf_size is initialized from the
> caller's bufsize argument without rejecting buffers smaller than
> sizeof(struct statmount), allowing string offset calculations relative
> to sizeof(struct statmount) to underflow or write past the user buffer.
> Reject bufsize < sizeof(struct statmount) in prepare_kstatmount().
> 
> Fixes: 68385d77c05b ("statmount: simplify string option retrieval")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

Yeah, indeed it looks like we could overrun the user buffer. Feel free to
add:

Reviewed-by: Jan Kara <jack@xxxxxxx>

								Honza

> ---
> diff --git a/fs/namespace.c b/fs/namespace.c
> index ae5dc64f8b45..7f7905286fa6 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -5882,7 +5882,7 @@ static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
>  	ks->bufsize = bufsize;
>  
>  	if (ks->mask & STATMOUNT_STRING_REQ) {
> -		if (bufsize == sizeof(ks->sm))
> +		if (bufsize <= sizeof(ks->sm))
>  			return -EOVERFLOW;
>  
>  		ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR