From patchwork Sat May 13 05:12:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Theodore Tso X-Patchwork-Id: 1780899 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org (client-ip=2404:9400:2221:ea00::3; helo=gandalf.ozlabs.org; envelope-from=srs0=zebo=bc=vger.kernel.org=linux-ext4-owner@ozlabs.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256 header.s=outgoing header.b=H3Spfb8s; dkim-atps=neutral Received: from gandalf.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QJDK30HdSz20KF for ; Sat, 13 May 2023 15:12:22 +1000 (AEST) Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by gandalf.ozlabs.org (Postfix) with ESMTP id 4QJDK22SQlz4x4m for ; Sat, 13 May 2023 15:12:22 +1000 (AEST) Received: by gandalf.ozlabs.org (Postfix) id 4QJDK22GB1z4xD5; Sat, 13 May 2023 15:12:22 +1000 (AEST) Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: gandalf.ozlabs.org; dmarc=fail (p=none dis=none) header.from=mit.edu Authentication-Results: gandalf.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=linux-ext4-owner@vger.kernel.org; receiver=) Authentication-Results: gandalf.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256 header.s=outgoing header.b=H3Spfb8s; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by gandalf.ozlabs.org (Postfix) with ESMTP id 4QJDK2220vz4x4m for ; Sat, 13 May 2023 15:12:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230020AbjEMFMT (ORCPT ); Sat, 13 May 2023 01:12:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229820AbjEMFMS (ORCPT ); Sat, 13 May 2023 01:12:18 -0400 Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1C031FFD for ; Fri, 12 May 2023 22:12:16 -0700 (PDT) Received: from cwcc.thunk.org (pool-173-48-120-46.bstnma.fios.verizon.net [173.48.120.46]) (authenticated bits=0) (User authenticated as tytso@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 34D5CBFI031825 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 13 May 2023 01:12:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing; t=1683954733; bh=Z9iTjbm9SMt9wT4jX1BZJRVbO2Yi+YQG1jXEhxRUXOY=; h=From:To:Cc:Subject:Date; b=H3Spfb8s+kCEcEDcdMQqUUZNTxChMDicBw35bOD/aAj26rFBJoCO49JCFtJV2Q80r tZYWARSISovMJ5qKwJ9Ef8AbYDltzlKt9Al0qb3BMVzsqM6XHlSsqam9+i4ljdNxB2 l9z+T1etZDLejeibluCekvvcJfJfkTKcXD5pLGd4zJpwGuVefYDqdfTJy8eYvE31I7 oibIUYE/tiw5Gp5LkoowD/D22uPl5iwNq0y6O38sizq+J4xVeGbqWzm0QRU/t2zLeo 0XgTb9YrgJeO6nOQcR238WkXYBLSb8PK4FqqS5Ro6XjgxAk6GMj5ez4z2wwcHItlLn y3HEU7uVYvcFg== Received: by cwcc.thunk.org (Postfix, from userid 15806) id 302B515C02E6; Sat, 13 May 2023 01:12:11 -0400 (EDT) From: "Theodore Ts'o" Cc: Ext4 Developers List , "Theodore Ts'o" , syzbot+1966db24521e5f6e23f7@syzkaller.appspotmail.com Subject: [PATCH -v2 1/2] ext4: add bounds checking in get_max_inline_xattr_value_size() Date: Sat, 13 May 2023 01:12:09 -0400 Message-Id: <20230513051210.1446682-1-tytso@mit.edu> X-Mailer: git-send-email 2.31.0 MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,RCVD_IN_DNSWL_MED,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is writing to the block device while the file system is mounted, it's possible for the inode table to get corrupted. Add bounds checking to avoid reading beyond the end of allocated memory if this happens. Reported-by: syzbot+1966db24521e5f6e23f7@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=1966db24521e5f6e23f7 Signed-off-by: Theodore Ts'o --- Changes from -v1: none fs/ext4/inline.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index d3dfc51a43c5..f47adb284e90 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -34,6 +34,7 @@ static int get_max_inline_xattr_value_size(struct inode *inode, struct ext4_xattr_ibody_header *header; struct ext4_xattr_entry *entry; struct ext4_inode *raw_inode; + void *end; int free, min_offs; if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) @@ -57,14 +58,23 @@ static int get_max_inline_xattr_value_size(struct inode *inode, raw_inode = ext4_raw_inode(iloc); header = IHDR(inode, raw_inode); entry = IFIRST(header); + end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; /* Compute min_offs. */ - for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) { + while (!IS_LAST_ENTRY(entry)) { + void *next = EXT4_XATTR_NEXT(entry); + + if (next >= end) { + EXT4_ERROR_INODE(inode, + "corrupt xattr in inline inode"); + return 0; + } if (!entry->e_value_inum && entry->e_value_size) { size_t offs = le16_to_cpu(entry->e_value_offs); if (offs < min_offs) min_offs = offs; } + entry = next; } free = min_offs - ((void *)entry - (void *)IFIRST(header)) - sizeof(__u32); From patchwork Sat May 13 05:12:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Theodore Tso X-Patchwork-Id: 1780900 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org (client-ip=150.107.74.76; helo=gandalf.ozlabs.org; envelope-from=srs0=zebo=bc=vger.kernel.org=linux-ext4-owner@ozlabs.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256 header.s=outgoing header.b=mKoQ9E84; dkim-atps=neutral Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QJDK31Q2Dz20dF for ; Sat, 13 May 2023 15:12:23 +1000 (AEST) Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by gandalf.ozlabs.org (Postfix) with ESMTP id 4QJDK30v2Gz4x4m for ; Sat, 13 May 2023 15:12:23 +1000 (AEST) Received: by gandalf.ozlabs.org (Postfix) id 4QJDK30l18z4xD5; Sat, 13 May 2023 15:12:23 +1000 (AEST) Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: gandalf.ozlabs.org; dmarc=fail (p=none dis=none) header.from=mit.edu Authentication-Results: gandalf.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=linux-ext4-owner@vger.kernel.org; receiver=) Authentication-Results: gandalf.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256 header.s=outgoing header.b=mKoQ9E84; dkim-atps=neutral Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by gandalf.ozlabs.org (Postfix) with ESMTP id 4QJDK30V13z4x4m for ; Sat, 13 May 2023 15:12:23 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230086AbjEMFMU (ORCPT ); Sat, 13 May 2023 01:12:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229901AbjEMFMS (ORCPT ); Sat, 13 May 2023 01:12:18 -0400 Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F9722715 for ; Fri, 12 May 2023 22:12:17 -0700 (PDT) Received: from cwcc.thunk.org (pool-173-48-120-46.bstnma.fios.verizon.net [173.48.120.46]) (authenticated bits=0) (User authenticated as tytso@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 34D5CDBZ031880 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 13 May 2023 01:12:14 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing; t=1683954734; bh=uqIKSjRFrI+pgqi4RSK1fUj09thg8GlQb0skDlD1b0I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mKoQ9E84GS4bfX6gVwev7Qf63U3eq0dBpDxteiy6Rda7RLHnf0soJe69VAzMAfl4K DyPxiWsE/FAT0XERszIPT95l75G+sMRxvPMeSplFfSnedzNlsJ46NAVrtbQ26/s3Tk eYYMBAC8Ri7gM8E+K1kcrcfTZDt+U85ieHTNaJ+zwggyrY12MdluMD3GtvQMWmvLSG ZuzU8mCj1c+kKzq+dr+06dkM/mLmN0NE1uxuqK9vd6OYBShN0526d+5MirwDq5zuW9 JHP2/94lfiEnUEWH17lZUxIljWXr8kBbxukqbx5BVyejPskGwAr5qmpYH/3BmRN7u4 skSEFIp17bEig== Received: by cwcc.thunk.org (Postfix, from userid 15806) id 414FB15C02E7; Sat, 13 May 2023 01:12:13 -0400 (EDT) From: "Theodore Ts'o" Cc: Ext4 Developers List , "Theodore Ts'o" Subject: [PATCH -v2 2/2] ext4: bail out of ext4_xattr_ibody_get() fails for any reason Date: Sat, 13 May 2023 01:12:10 -0400 Message-Id: <20230513051210.1446682-2-tytso@mit.edu> X-Mailer: git-send-email 2.31.0 In-Reply-To: <20230513051210.1446682-1-tytso@mit.edu> References: <20230513051210.1446682-1-tytso@mit.edu> MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,RCVD_IN_DNSWL_MED,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org If ext4_update_inline_data() fails for any reason, it's best if we just fail as opposed to stumbling on, especially if the failure is EFSCORRUPTED. Signed-off-by: Theodore Ts'o --- Changes from -v1: fixed error check to be for negative values fs/ext4/inline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index f47adb284e90..5854bd5a3352 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -360,7 +360,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, error = ext4_xattr_ibody_get(inode, i.name_index, i.name, value, len); - if (error == -ENODATA) + if (error < 0) goto out; BUFFER_TRACE(is.iloc.bh, "get_write_access");