lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE
PATCH 1/1 lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE
When using utilities like lsattr/chattr on a FUSE backing file-system, invoking the fgetversion or fsetversion functions can result in an abort crash due to "*** stack smashing detected ***".
The underlying cause lies in a data structure mismatch between the variable allocation space in user-space and the ioctl encoding expectations defined by Linux: the ioctl command token incorporates the 'long' primitive data size, so the kernel explicitly encodes a 64-bit target memory region pointer when deployed on x86_64. FUSE driver enforce the _IOR-decoded payload envelope, hence it uses 8-byte buffer to accommodate the incoming user-space daemon response. When finalizing the ioctl transaction back down to user space, it writes all 8-bytes directly into the 4-bytes memory reference provided by e2fsprogs.
Reproduce: compile with '-fstack-protector-strong' and '-D_FORTIFY_SOURCE=3' (fedor44, 7.2.5-200.fc44.x86_64):
$ lsattr -v ./foo *** stack smashing detected ***: terminated Aborted (core dumped) lsattr -v ./foo
Solution: change ioctl arg to 'long' but use only lower 32-bits of result.
--- lib/e2p/fgetversion.c | 4 ++-- lib/e2p/fsetversion.c | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-)
lib/e2p/fgetversion.c +2 -2
@@ -45,7 +45,7 @@int fgetversion (const char *name,unsigned long *version) { -unsigned int ver =-1 ; +long ver =0 ;int rc =-1 ;#if HAVE_EXT2_IOCTLS # if !APPLE_DARWIN
@@ -68,7 +68,7 @@ int fgetversion(const char *name, unsigned long *version) errno =EOPNOTSUPP ;#endif /* ! HAVE_EXT2_IOCTLS */ if (rc ==0 ) - *version = ver; + *version = (unsigned long )ver &0xffffffffUL ;return rc; }
lib/e2p/fsetversion.c +4 -3
@@ -47,12 +47,13 @@ int fsetversion (const char * name, unsigned long version) {#if HAVE_EXT2_IOCTLS #if !APPLE_DARWIN -int fd, r, ver, save_errno =0 ; +int fd, r, save_errno =0 ; +long ver; fd =open (name,OPEN_FLAGS );if (fd ==-1 )return -1 ; - ver = (int ) version; + ver = (long ) (version &0xffffffffUL ); r =ioctl (fd,EXT2_IOC_SETVERSION , &ver);if (r ==-1 ) save_errno = errno;
@@ -61,7 +62,7 @@ int fsetversion (const char * name, unsigned long version) errno = save_errno;return r;#else -int ver = (int )version; +long ver = (long )(version &0xffffffffUL );return syscall (SYS_fsctl, name,EXT2_IOC_SETVERSION , &ver,0 );#endif #else /* ! HAVE_EXT2_IOCTLS */
Signature · 1 line
2.55.0