1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2019 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
6 * XFS had a memory corruption bug in its handling of the POSIX ACL attribute
7 * names during a listxattr call.
9 * On IRIX, file ACLs were stored under the name "trusted.SGI_ACL_FILE",
10 * whereas on Linux the name is "system.posix_acl_access". In order to
11 * maintain compatibility with old filesystems, XFS internally continues to
12 * use the old SGI_ACL_FILE name on disk and remap the new name whenever it
15 * In order to make this magic happen, XFS' listxattr implementation will emit
16 * first the Linux name and then the on-disk name. Unfortunately, it doesn't
17 * correctly check the buffer length, so if the buffer is large enough to fit
18 * the on-disk name but not large enough to fit the Linux name, we screw up
19 * the buffer position accounting while trying to emit the Linux name and then
20 * corrupt memory when we try to emit the on-disk name.
22 * If we trigger the bug, the program will print the garbled string
23 * "rusted.SGI_ACL_FILE". If the bug is fixed, the flistxattr call returns
26 #include <sys/types.h>
34 #include <sys/xattr.h>
37 void die(const char *msg)
54 int main(int argc, char *argv[])
56 /* posix_acl_xattr_entry/header need little-endian order */
62 {htole16(0x10), htole16(4), 0},
63 {htole16(0x20), 0, 0},
77 fd = creat("file0", 0644);
81 ret = fsetxattr(fd, "system.posix_acl_access", &acl, sizeof(acl), 0);
85 sz = flistxattr(fd, buf, 20);
94 /* original syzkaller reproducer */
96 syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
98 memcpy((void*)0x20000180, "./file0", 8);
99 syscall(__NR_creat, 0x20000180, 0);
100 memcpy((void*)0x20000000, "./file0", 8);
101 memcpy((void*)0x20000040, "system.posix_acl_access", 24);
102 *(uint32_t*)0x20000680 = 2;
103 *(uint16_t*)0x20000684 = 1;
104 *(uint16_t*)0x20000686 = 0;
105 *(uint32_t*)0x20000688 = 0;
106 *(uint16_t*)0x2000068c = 4;
107 *(uint16_t*)0x2000068e = 0;
108 *(uint32_t*)0x20000690 = 0;
109 *(uint16_t*)0x20000694 = 0x10;
110 *(uint16_t*)0x20000696 = 0;
111 *(uint32_t*)0x20000698 = 0;
112 *(uint16_t*)0x2000069c = 0x20;
113 *(uint16_t*)0x2000069e = 0;
114 *(uint32_t*)0x200006a0 = 0;
115 syscall(__NR_setxattr, 0x20000000, 0x20000040, 0x20000680, 0x24, 0);
116 memcpy((void*)0x20000080, "./file0", 8);
117 memcpy((void*)0x200000c0, "security.evm", 13);
118 memcpy((void*)0x20000100, "\x03\x00\x00\x00\x57", 5);
119 syscall(__NR_lsetxattr, 0x20000080, 0x200000c0, 0x20000100, 1, 1);
120 memcpy((void*)0x20000300, "./file0", 8);
121 syscall(__NR_listxattr, 0x20000300, 0x200002c0, 0x1e);