Patch "xfs: fix over-copying of getbmap parameters from userspace" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

xfs: fix over-copying of getbmap parameters from userspace

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xfs-fix-over-copying-of-getbmap-parameters-from-userspace.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Darrick J. Wong" <[email protected]>
Date: Mon, 3 Apr 2017 15:17:57 -0700
Subject: xfs: fix over-copying of getbmap parameters from userspace

From: Darrick J. Wong <[email protected]>

commit be6324c00c4d1e0e665f03ed1fc18863a88da119 upstream.

In xfs_ioc_getbmap, we should only copy the fields of struct getbmap from userspace, or else we end up copying random stack contents into the kernel. struct getbmap is a strict subset of getbmapx, so a partial structure copy should work fine.

---
 fs/xfs/xfs_ioctl.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -1378,10 +1378,11 @@ xfs_ioc_getbmap(
 	unsigned int		cmd,
 	void			__user *arg)
 {
-	struct getbmapx		bmx;
+	struct getbmapx		bmx = { 0 };
 	int			error;
 
-	if (copy_from_user(&bmx, arg, sizeof(struct getbmapx)))
+	/* struct getbmap is a strict subset of struct getbmapx. */
+	if (copy_from_user(&bmx, arg, offsetof(struct getbmapx, bmv_iflags)))
 		return -EFAULT;
 
 	if (bmx.bmv_count < 2)

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/xfs-fix-missed-holes-in-seek_hole-implementation.patch queue-3.18/xfs-fix-indlen-accounting-error-on-partial-delalloc-conversion.patch queue-3.18/xfs-fix-over-copying-of-getbmap-parameters-from-userspace.patch queue-3.18/xfs-bad-assertion-for-delalloc-an-extent-that-start-at-i_size.patch queue-3.18/xfs-fix-off-by-one-on-max-nr_pages-in-xfs_find_get_desired_pgoff.patch queue-3.18/xfs-fix-up-quotacheck-buffer-list-error-handling.patch queue-3.18/xfs-xfs_trans_alloc_empty.patch queue-3.18/xfs-prevent-multi-fsb-dir-readahead-from-reading-random-blocks.patch queue-3.18/xfs-fix-unaligned-access-in-xfs_btree_visit_blocks.patch queue-3.18/xfs-handle-array-index-overrun-in-xfs_dir2_leaf_readbuf.patch