| Message ID | 20260918101249.43643-1-zhaogongyi@bytedance.com |
|---|---|
| State | New |
| Headers | show |
| Series | ext4: fix OOB memmove in ext4_xattr_set_entry | expand |
> A corrupted filesystem can leave an inode marked as having inline data > while the system.data xattr is missing. ext4_destroy_inline_data_nolock() > then asks ext4_xattr_set_entry() to remove an entry even though > ext4_xattr_ibody_find() left the search state at the insertion position. > > In the syzkaller reproducer, the old xattr value offset is smaller than > min_offs. ext4_xattr_set_entry() then computes val - first_val for > memmove(), the length wraps to a huge size_t, and memmove() can run out of > the xattr buffer. This results in an out-of-bounds memmove and a kernel > page fault. > > A crafted corrupted ext4 image can trigger this while inline data is being > converted out of the inode. Treat the inconsistent inline/xattr state as > filesystem corruption before updating the xattr entry. > > [ ... ] > 120 seconds without triggering KASAN, Oops, a memmove fault, or panic. > > Fixes: 67cf5b09a46f ("ext4: add the basic function for inline data support") > Cc: stable@vger.kernel.org # v3.8+ > Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com> Sashiko has reviewed this patch and found no issues. It looks great!
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index ceee69a66..0a30d40cb 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -461,6 +461,12 @@ static int ext4_destroy_inline_data_nolock(handle_t *handle, error = ext4_xattr_ibody_find(inode, &i, &is); if (error) goto out; + if (is.s.not_found) { + EXT4_ERROR_INODE(inode, + "corrupted inline data without system.data xattr"); + error = -EFSCORRUPTED; + goto out; + } BUFFER_TRACE(is.iloc.bh, "get_write_access"); error = ext4_journal_get_write_access(handle, inode->i_sb, is.iloc.bh, diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 5c310747b..9a0ee5779 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1712,6 +1712,18 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, } } + if (!s->not_found && here->e_value_size && !here->e_value_inum) { + size_t offs = le16_to_cpu(here->e_value_offs); + + if (offs < min_offs) { + EXT4_ERROR_INODE(inode, + "corrupted xattr: value offset %zu < min_offs %zu", + offs, min_offs); + ret = -EFSCORRUPTED; + goto out; + } + } + /* * Getting access to old and new ea inodes is subject to failures. * Finish that work before doing any modifications to the xattr data.
A corrupted filesystem can leave an inode marked as having inline data while the system.data xattr is missing. ext4_destroy_inline_data_nolock() then asks ext4_xattr_set_entry() to remove an entry even though ext4_xattr_ibody_find() left the search state at the insertion position. In the syzkaller reproducer, the old xattr value offset is smaller than min_offs. ext4_xattr_set_entry() then computes val - first_val for memmove(), the length wraps to a huge size_t, and memmove() can run out of the xattr buffer. This results in an out-of-bounds memmove and a kernel page fault. A crafted corrupted ext4 image can trigger this while inline data is being converted out of the inode. Treat the inconsistent inline/xattr state as filesystem corruption before updating the xattr entry. The issue was found by syzkaller and reproduced with the generated C reproducer. The crash signature is: BUG: unable to handle page fault for address: ffff8880074cf000 RIP: 0010:memmove+0x28/0x1b0 Call Trace: ext4_xattr_set_entry+0xe2f/0x1e90 fs/ext4/xattr.c:1761 ext4_xattr_ibody_set+0x3d6/0x5d0 fs/ext4/xattr.c:2268 ext4_destroy_inline_data_nolock+0x288/0x5b0 fs/ext4/inline.c:467 ext4_convert_inline_data_nolock+0x178/0xe80 fs/ext4/inline.c:1222 ext4_convert_inline_data+0x52a/0x610 fs/ext4/inline.c:2083 ext4_fallocate+0x1a0/0x3ba0 fs/ext4/extents.c:4752 Reject the missing system.data xattr before destroying inline data, and validate the old value offset before ext4_xattr_set_entry() reaches the memmove(). The crash was reproduced on unpatched 7.3.0-rc3 and 6.6.122 kernels. With this fix applied to both versions, the same syzkaller C reproducer ran for 120 seconds without triggering KASAN, Oops, a memmove fault, or panic. Fixes: 67cf5b09a46f ("ext4: add the basic function for inline data support") Cc: stable@vger.kernel.org # v3.8+ Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com> --- fs/ext4/inline.c | 6 ++++++ fs/ext4/xattr.c | 12 ++++++++++++ 2 files changed, 18 insertions(+)