UBUNTU: SAUCE: vfs: test that one given mount param is not larger than PAGE_SIZE

Thadeu Lima de Souza Cascardo · Thadeu Lima de Souza Cascardo · commit 114ca32cbf0e · 2022-01-12T11:51:53.000-03:00
In order to avoid potential overflows, test that one given mount parameter
is not larger than PAGE_SIZE when parsing it through legacy_parse_param.

Suggested-by: Stefan Bader &lt;stefan.bader@canonical.com&gt;
Signed-off-by: Thadeu Lima de Souza Cascardo &lt;cascardo@canonical.com&gt;
CVE-2022-0185
Acked-by: Andy Whitcroft &lt;andy.whitcroft@canonical.com&gt;
Acked-by: Ben Romer &lt;ben.romer@canonical.com&gt;
diff --git a/fs/fs_context.c b/fs/fs_context.c
@@ -585,7 +585,7 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)
 			      param->key);
 	}
 
-	if (size + len + 2 > PAGE_SIZE)
+	if (len > PAGE_SIZE || size + len + 2 > PAGE_SIZE)
 		return invalf(fc, "VFS: Legacy: Cumulative options too large");
 	if (strchr(param->key, ',') ||
 	    (param->type == fs_value_is_string &&

Original file line number	Diff line number	Diff line change
`@@ -585,7 +585,7 @@ static int legacy_parse_param(struct fs_context fc, struct fs_parameter param)`
`585`	`585`	`param->key);`
`586`	`586`	`}`
`587`	`587`
`588`		`- if (size + len + 2 > PAGE_SIZE)`
	`588`	`+ if (len > PAGE_SIZE \|\| size + len + 2 > PAGE_SIZE)`
`589`	`589`	`return invalf(fc, "VFS: Legacy: Cumulative options too large");`
`590`	`590`	`if (strchr(param->key, ',') \|\|`
`591`	`591`	`(param->type == fs_value_is_string &&`