From nobody Wed May 8 05:44:53 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4C87C6FD20 for ; Fri, 24 Mar 2023 20:19:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231859AbjCXUT6 (ORCPT ); Fri, 24 Mar 2023 16:19:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59640 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231196AbjCXUTz (ORCPT ); Fri, 24 Mar 2023 16:19:55 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA2DC90; Fri, 24 Mar 2023 13:19:54 -0700 (PDT) Received: from fpc.intra.ispras.ru (unknown [10.10.165.3]) by mail.ispras.ru (Postfix) with ESMTPSA id 19C2940737A8; Fri, 24 Mar 2023 20:19:53 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 19C2940737A8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1679689193; bh=QcyGJ9bDGDc2f7NKHrplRfNToMDPqANILV6S6j5wK3c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jkOh+A5lL5MMspopUCRQe4gy24gOZk24gg0dOqh3J5xWupOWB5g5W9c1oJuframkb CKRudsDaRF0CfMq3ON7Y0JvIEXBdfwB9HVNsnQEEGgEG67vZvVmpGQpAB+4xZhvKWw iGKNsnXQA0M8+k9nR42NNtpaDCDs65R8gEyG3M6E= From: Fedor Pchelkin To: Greg Kroah-Hartman , stable@vger.kernel.org Cc: Fedor Pchelkin , Andreas Gruenbacher , cluster-devel@redhat.com, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Subject: [PATCH 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes Date: Fri, 24 Mar 2023 23:19:33 +0300 Message-Id: <20230324201933.329885-2-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230324201933.329885-1-pchelkin@ispras.ru> References: <20230324201933.329885-1-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin --- fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, stru= ct page *page) return error; =20 kaddr =3D kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize =3D gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, str= uct buffer_head *dibh, void *kaddr =3D kmap(page); u64 dsize =3D i_size_read(inode); =20 - if (dsize > gfs2_max_stuffed_size(ip)) - dsize =3D gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const = void *buf) ip->i_depth =3D (u8)depth; ip->i_entries =3D be32_to_cpu(str->di_entries); =20 + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode); =20 --=20 2.34.1