Re: [PATCH] um: ubd: validate COW header fields before use

On Mon, Jun 22, 2026 at 2:48=E2=80=AFPM Michael Bommarito
<[email protected]> wrote:
>
> read_cow_header() copies the backing-file path and computes geometry
> from header fields without validating them, and the historical
> "XXX Need to sanity-check the values read from the header" comment was
> never addressed. Three image-controlled fields are unsafe:
>
>   - backing_file[]: not guaranteed NUL-terminated. cow_strdup() and the
>     later strlen()/printf() walk off the end of the header buffer when a
>     crafted image leaves the array unterminated (heap over-read).
>
>   - sectorsize: used as a divisor in cow_sizes()
>     (bitmap_len =3D (size + sectorsize - 1) / (8 * sectorsize)); a zero o=
r
>     negative sectorsize causes a divide-by-zero / bogus geometry.
>
>   - For the V3/V3_b layouts the existing "align =3D=3D 0" check printed a
>     warning but fell through and then computed
>     ROUND_UP(sizeof(header), 0), another divide-by-zero.
>
> Reject an unterminated backing_file for each header version, turn the
> align =3D=3D 0 warnings into hard errors (goto out), and reject a
> non-positive sectorsize before the geometry math runs.
>
> A COW image is parsed from a file the guest opens (ubdN=3Dcow,backing on
> the command line, or a cow file an unprivileged user can point ubd at),
> so a crafted header is attacker-reachable.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <[email protected]>
> ---
> Reproduced on a UML KASAN build (ARCH=3Dum) off this base, driving ubd wi=
th
> crafted COW images. Stock: an unterminated v2 backing_file over-reads the
> header buffer (KASAN slab-out-of-bounds read in the strdup/strlen path); =
a
> sectorsize=3D0 image and a v3 alignment=3D0 image each hit a divide error=
 in
> the cow_sizes()/ROUND_UP geometry. Patched: each crafted image is rejecte=
d
> in read_cow_header() ('not terminated' / 'invalid sectorsize' / 'align =
=3D=3D
> 0') and the driver continues. Benign control: a valid COW image opens
> cleanly on both stock and patched. Before/after logs available on request=
.
>
>  arch/um/drivers/cow_user.c | 34 +++++++++++++++++++++++++++++++++-
>  1 file changed, 33 insertions(+), 1 deletion(-)

Reviewed-by: Richard Weinberger <[email protected]>

--=20
Thanks,
//richard