dc487321b1
In ll_dir_ioctl(), the object lumv3 is firstly copied from the user space using Its address, i.e., lumv1 = &lumv3. If the lmm_magic field of lumv3 is LOV_USER_MAGIC_V3, lumv3 will be modified by the second copy from the user space. The second copy is necessary, because the two versions (i.e., lov_user_md_v1 and lov_user_md_v3) have different data formats and lengths. However, given that the user data resides in the user space, a malicious user-space process can race to change the data between the two copies. By doing so, the attacker can provide a data with an inconsistent version, e.g., v1 version + v3 data. This can lead to logical errors in the following execution in ll_dir_setstripe(), which performs different actions according to the version specified by the field lmm_magic. This patch rechecks the version field lmm_magic in the second copy. If the version is not as expected, i.e., LOV_USER_MAGIC_V3, an error code will be returned: -EINVAL. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Reviewed-by: Andreas Dilger <andreas.dilger@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux kernel
============
There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.
In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``. The formatted documentation can also be read online at:
https://www.kernel.org/doc/html/latest/
There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.
Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.