From nobody Mon Apr 27 08:43:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7B83C433EF for ; Wed, 15 Jun 2022 03:54:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349487AbiFODyz (ORCPT ); Tue, 14 Jun 2022 23:54:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36372 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353866AbiFODyJ (ORCPT ); Tue, 14 Jun 2022 23:54:09 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 029B4D95; Tue, 14 Jun 2022 20:53:37 -0700 (PDT) Received: from dggpeml500021.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4LNBGt1SmHzDrJQ; Wed, 15 Jun 2022 11:53:10 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 15 Jun 2022 11:53:35 +0800 From: Baokun Li To: CC: , , , , , , , , , , Subject: [PATCH v2 1/4] ext4: add EXT4_INODE_HAVE_XATTR_SPACE macro in xattr.h Date: Wed, 15 Jun 2022 12:06:27 +0800 Message-ID: <20220615040630.808783-2-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220615040630.808783-1-libaokun1@huawei.com> References: <20220615040630.808783-1-libaokun1@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h index 77efb9a627ad..3fd17b25596f 100644 --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -95,6 +95,19 @@ struct ext4_xattr_entry { =20 #define EXT4_ZERO_XATTR_VALUE ((void *)-1) =20 +/* + * If we want to add an xattr to the inode, we should make sure that + * i_extra_isize is not 0 and that the inode size is not less than + * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. + * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data + * |--------------------------|------------|------|---------|---|-------| + */ +#define EXT4_INODE_HAVE_XATTR_SPACE(inode) \ + ((EXT4_I(inode)->i_extra_isize !=3D 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <=3D \ + EXT4_INODE_SIZE((inode)->i_sb))) + struct ext4_xattr_info { const char *name; const void *value; --=20 2.31.1 From nobody Mon Apr 27 08:43:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0AA7FC43334 for ; Wed, 15 Jun 2022 03:55:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231685AbiFODzI (ORCPT ); Tue, 14 Jun 2022 23:55:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353953AbiFODyQ (ORCPT ); Tue, 14 Jun 2022 23:54:16 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BF0C13EBA; Tue, 14 Jun 2022 20:53:38 -0700 (PDT) Received: from dggpeml500021.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4LNBG74LpWzjY6D; Wed, 15 Jun 2022 11:52:31 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 15 Jun 2022 11:53:35 +0800 From: Baokun Li To: CC: , , , , , , , , , , , Hulk Robot Subject: [PATCH v2 2/4] ext4: fix use-after-free in ext4_xattr_set_entry Date: Wed, 15 Jun 2022 12:06:28 +0800 Message-ID: <20220615040630.808783-3-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220615040630.808783-1-libaokun1@huawei.com> References: <20220615040630.808783-1-libaokun1@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Hulk Robot reported a issue: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500 Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092 CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17 Call Trace: [...] memcpy+0x34/0x50 mm/kasan/kasan.c:303 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498 __vfs_setxattr+0x112/0x170 fs/xattr.c:149 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238 vfs_setxattr+0xed/0x270 fs/xattr.c:255 setxattr+0x235/0x330 fs/xattr.c:520 path_setxattr+0x176/0x190 fs/xattr.c:539 __do_sys_lsetxattr fs/xattr.c:561 [inline] __se_sys_lsetxattr fs/xattr.c:557 [inline] __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x459fe9 RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9 RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80 [...] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Above issue may happen as follows: Reported-by: Hulk Robot ------------------------------------- ext4_xattr_set ext4_xattr_set_handle ext4_xattr_ibody_find >> s->end < s->base >> no EXT4_STATE_XATTR >> xattr_check_inode is not executed ext4_xattr_ibody_set ext4_xattr_set_entry >> size_t min_offs =3D s->end - s->base >> UAF in memcpy we can easily reproduce this problem with the following commands: mkfs.ext4 -F /dev/sda mount -o debug_want_extra_isize=3D128 /dev/sda /mnt touch /mnt/file setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file In ext4_xattr_ibody_find, we have the following assignment logic: header =3D IHDR(inode, raw_inode) =3D raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize is->s.base =3D IFIRST(header) =3D header + sizeof(struct ext4_xattr_ibody_header) is->s.end =3D raw_inode + s_inode_size In ext4_xattr_set_entry min_offs =3D s->end - s->base =3D s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) last =3D s->first free =3D min_offs - ((void *)last - s->base) - sizeof(__u32) =3D s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32) In the calculation formula, all values except s_inode_size and i_extra_size are fixed values. When i_extra_size is the maximum value s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8. The value overflows. As a result, the preceding issue is triggered when memcpy is executed. EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data |---------------------------|------------|------|---------|---|--------| As shown above, when adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Reported-by: Hulk Robot Signed-off-by: Baokun Li --- fs/ext4/xattr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 042325349098..c95f9fd747b6 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2176,8 +2176,9 @@ int ext4_xattr_ibody_find(struct inode *inode, struct= ext4_xattr_info *i, struct ext4_inode *raw_inode; int error; =20 - if (EXT4_I(inode)->i_extra_isize =3D=3D 0) + if (!EXT4_INODE_HAVE_XATTR_SPACE(inode)) return 0; + raw_inode =3D ext4_raw_inode(&is->iloc); header =3D IHDR(inode, raw_inode); is->s.base =3D is->s.first =3D IFIRST(header); @@ -2205,8 +2206,9 @@ int ext4_xattr_ibody_set(handle_t *handle, struct ino= de *inode, struct ext4_xattr_search *s =3D &is->s; int error; =20 - if (EXT4_I(inode)->i_extra_isize =3D=3D 0) + if (!EXT4_INODE_HAVE_XATTR_SPACE(inode)) return -ENOSPC; + error =3D ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */); if (error) return error; --=20 2.31.1 From nobody Mon Apr 27 08:43:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9D16C433EF for ; Wed, 15 Jun 2022 03:55:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353967AbiFODzB (ORCPT ); Tue, 14 Jun 2022 23:55:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353892AbiFODyP (ORCPT ); Tue, 14 Jun 2022 23:54:15 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 637771570D; Tue, 14 Jun 2022 20:53:39 -0700 (PDT) Received: from dggpeml500021.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4LNBCb06twzRjSD; Wed, 15 Jun 2022 11:50:19 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 15 Jun 2022 11:53:36 +0800 From: Baokun Li To: CC: , , , , , , , , , , Subject: [PATCH v2 3/4] ext4: correct max_inline_xattr_value_size computing Date: Wed, 15 Jun 2022 12:06:29 +0800 Message-ID: <20220615040630.808783-4-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220615040630.808783-1-libaokun1@huawei.com> References: <20220615040630.808783-1-libaokun1@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" If the ext4 inode does not have xattr space, 0 is returned in the get_max_inline_xattr_value_size function. Otherwise, the function returns a negative value when the inode does not contain EXT4_STATE_XATTR. Signed-off-by: Baokun Li --- fs/ext4/inline.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index cff52ff6549d..20032dbcd6f5 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -35,6 +35,9 @@ static int get_max_inline_xattr_value_size(struct inode *= inode, struct ext4_inode *raw_inode; int free, min_offs; =20 + if (!EXT4_INODE_HAVE_XATTR_SPACE(inode)) + return 0; + min_offs =3D EXT4_SB(inode->i_sb)->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - EXT4_I(inode)->i_extra_isize - --=20 2.31.1 From nobody Mon Apr 27 08:43:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 049C8C43334 for ; Wed, 15 Jun 2022 03:55:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353734AbiFODy6 (ORCPT ); Tue, 14 Jun 2022 23:54:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36050 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353935AbiFODyP (ORCPT ); Tue, 14 Jun 2022 23:54:15 -0400 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90DBD193FE; Tue, 14 Jun 2022 20:53:39 -0700 (PDT) Received: from dggpeml500021.china.huawei.com (unknown [172.30.72.55]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4LNBF80r8Jz1K9hC; Wed, 15 Jun 2022 11:51:40 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 15 Jun 2022 11:53:37 +0800 From: Baokun Li To: CC: , , , , , , , , , , Subject: [PATCH v2 4/4] ext4: correct the misjudgment in ext4_iget_extra_inode Date: Wed, 15 Jun 2022 12:06:30 +0800 Message-ID: <20220615040630.808783-5-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220615040630.808783-1-libaokun1@huawei.com> References: <20220615040630.808783-1-libaokun1@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Use the EXT4_INODE_HAVE_XATTR_SPACE macro to more accurately determine whether the inode have xattr space. Signed-off-by: Baokun Li --- fs/ext4/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 3dce7d058985..e7c6d7e1b531 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4685,8 +4685,7 @@ static inline int ext4_iget_extra_inode(struct inode = *inode, __le32 *magic =3D (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; =20 - if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=3D - EXT4_INODE_SIZE(inode->i_sb) && + if (EXT4_INODE_HAVE_XATTR_SPACE(inode) && *magic =3D=3D cpu_to_le32(EXT4_XATTR_MAGIC)) { ext4_set_inode_state(inode, EXT4_STATE_XATTR); return ext4_find_inline_data_nolock(inode); --=20 2.31.1