mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

tomoyo: Limit wildcard recursion depth. 

Since wildcards that need recursion consume kernel stack memory (or might
cause CPU stall warning problem), we cannot allow infinite recursion.

Since TOMOYO 1.8 survived with 20 recursions limit for 5 years, nobody
would complain if applying this limit to TOMOYO 2.6.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
This commit is contained in:
Tetsuo Handa 2020-11-03 13:17:40 +09:00
parent d9594e0409
commit e991a40b3d
1 changed files with 30 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
security/tomoyo/util.c
View File

@ -434,59 +434,64 @@ void tomoyo_normalize_line(unsigned char *buffer)
*/
static bool tomoyo_correct_word2(const char *string, size_t len)
{
u8 recursion = 20;
const char *const start = string;
bool in_repetition = false;
unsigned char c;
unsigned char d;
unsigned char e;
if (!len)
goto out;
while (len--) {
c = *string++;
unsigned char c = *string++;
if (c == '\\') {
if (!len--)
goto out;
c = *string++;
if (c >= '0' && c <= '3') {
unsigned char d;
unsigned char e;
if (!len-- || !len--)
goto out;
d = *string++;
e = *string++;
if (d < '0' || d > '7' || e < '0' || e > '7')
goto out;
c = tomoyo_make_byte(c, d, e);
if (c <= ' ' || c >= 127)
continue;
goto out;
}
switch (c) {
case '\\': /* "\\" */
continue;
case '$': /* "\$" */
case '+': /* "\+" */
case '?': /* "\?" */
case 'x': /* "\x" */
case 'a': /* "\a" */
case '-': /* "\-" */
continue;
}
if (!recursion--)
goto out;
switch (c) {
case '*': /* "\*" */
case '@': /* "\@" */
case 'x': /* "\x" */
case '$': /* "\$" */
case 'X': /* "\X" */
case 'a': /* "\a" */
case 'A': /* "\A" */
case '-': /* "\-" */
continue;
case '{': /* "/\{" */
if (string - 3 < start || *(string - 3) != '/')
break;
goto out;
in_repetition = true;
continue;
case '}': /* "\}/" */
if (*string != '/')
break;
goto out;
if (!in_repetition)
break;
goto out;
in_repetition = false;
continue;
case '0': /* "\ooo" */
case '1':
case '2':
case '3':
if (!len-- || !len--)
break;
d = *string++;
e = *string++;
if (d < '0' || d > '7' || e < '0' || e > '7')
break;
c = tomoyo_make_byte(c, d, e);
if (c <= ' ' || c >= 127)
continue;
}
goto out;
} else if (in_repetition && c == '/') {