Skip to contentSkip to conversation

lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE

PATCH New Shachar Sharon 1 participant 1 message Sep 21 FUSE filesystem core

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE

When using utilities like lsattr/chattr on a FUSE backing file-system, invoking the fgetversion or fsetversion functions can result in an abort crash due to "*** stack smashing detected ***".

The underlying cause lies in a data structure mismatch between the variable allocation space in user-space and the ioctl encoding expectations defined by Linux: the ioctl command token incorporates the 'long' primitive data size, so the kernel explicitly encodes a 64-bit target memory region pointer when deployed on x86_64. FUSE driver enforce the _IOR-decoded payload envelope, hence it uses 8-byte buffer to accommodate the incoming user-space daemon response. When finalizing the ioctl transaction back down to user space, it writes all 8-bytes directly into the 4-bytes memory reference provided by e2fsprogs.

Reproduce: compile with '-fstack-protector-strong' and '-D_FORTIFY_SOURCE=3' (fedor44, 7.2.5-200.fc44.x86_64):

  $ lsattr -v ./foo
  *** stack smashing detected ***: terminated
  Aborted                    (core dumped) lsattr -v ./foo

Solution: change ioctl arg to 'long' but use only lower 32-bits of result.

---
 lib/e2p/fgetversion.c | 4 ++--
 lib/e2p/fsetversion.c | 7 ++++---
 2 files changed, 6 insertions(+), 5 deletions(-)
lib/e2p/fgetversion.c +2 -2
index f3a5b4cd..eaac46c6 100644
@@ -45,7 +45,7 @@
 
 int fgetversion(const char *name, unsigned long *version)
 {
-	unsigned int ver = -1;
+	long ver = 0;
 	int rc = -1;
 #if HAVE_EXT2_IOCTLS
 # if !APPLE_DARWIN
@@ -68,7 +68,7 @@ int fgetversion(const char *name, unsigned long *version)
 	errno = EOPNOTSUPP;
 #endif /* ! HAVE_EXT2_IOCTLS */
 	if (rc == 0)
-		*version = ver;
+		*version = (unsigned long)ver & 0xffffffffUL;
 
 	return rc;
 }
lib/e2p/fsetversion.c +4 -3
index 5f844b55..9b599c19 100644
@@ -47,12 +47,13 @@ int fsetversion (const char * name, unsigned long version)
 {
 #if HAVE_EXT2_IOCTLS
 #if !APPLE_DARWIN
-	int fd, r, ver, save_errno = 0;
+	int fd, r, save_errno = 0;
+	long ver;
 
 	fd = open (name, OPEN_FLAGS);
 	if (fd == -1)
 		return -1;
-	ver = (int) version;
+	ver = (long) (version & 0xffffffffUL);
 	r = ioctl (fd, EXT2_IOC_SETVERSION, &ver);
 	if (r == -1)
 		save_errno = errno;
@@ -61,7 +62,7 @@ int fsetversion (const char * name, unsigned long version)
 		errno = save_errno;
 	return r;
 #else
-   int ver = (int)version;
+	long ver = (long)(version & 0xffffffffUL);
    return syscall(SYS_fsctl, name, EXT2_IOC_SETVERSION, &ver, 0);
 #endif
 #else /* ! HAVE_EXT2_IOCTLS */
Signature · 1 line
2.55.0