gfs2: add bounds check for rd_length in compute_bitstructs()

[PATCH] gfs2: add bounds check for rd_length in compute_bitstructs()

Posted by Kriish Sharma 1 week, 6 days ago

compute_bitstructs() allocates an array of gfs2_bitmap structures
using kcalloc(). The function only checked for length == 0 but did not
guard against excessively large length values.

If rd_length is too large, the multiplication inside
kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS) can exceed
KMALLOC_MAX_SIZE. This leads to the allocator calculating an order
greater than MAX_ORDER when calling get_order(), which is invalid.
As a result, __alloc_pages() warns about the bad request.

This patch adds an explicit check that rd_length is not only non-zero
but also within the maximum safe limit for kmalloc_array():
    length <= KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap)

This ensures that get_order() is only ever called with a valid size,
resulting in an allocation order within MAX_ORDER

Fixes: b9158815de52 ("Merge tag 'char-misc-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc")
Reported-by: syzbot+7567dc5c8aa8f68bde74@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74

Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
---
 fs/gfs2/rgrp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 26d6c1eea559..a879e8030568 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
 	u32 bytes_left, bytes;
 	int x;
 
-	if (!length)
+	if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap))
 		return -EINVAL;
 
 	rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS);
-- 
2.34.1

Re: [PATCH] gfs2: add bounds check for rd_length in compute_bitstructs()

Posted by Andreas Gruenbacher 1 week, 2 days ago

Kriish,

On Thu, Sep 18, 2025 at 10:49 PM Kriish Sharma
<kriish.sharma2006@gmail.com> wrote:
> compute_bitstructs() allocates an array of gfs2_bitmap structures
> using kcalloc(). The function only checked for length == 0 but did not
> guard against excessively large length values.
>
> If rd_length is too large, the multiplication inside
> kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS) can exceed
> KMALLOC_MAX_SIZE. This leads to the allocator calculating an order
> greater than MAX_ORDER when calling get_order(), which is invalid.
> As a result, __alloc_pages() warns about the bad request.
>
> This patch adds an explicit check that rd_length is not only non-zero
> but also within the maximum safe limit for kmalloc_array():
>     length <= KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap)
>
> This ensures that get_order() is only ever called with a valid size,
> resulting in an allocation order within MAX_ORDER
>
> Fixes: b9158815de52 ("Merge tag 'char-misc-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc")
> Reported-by: syzbot+7567dc5c8aa8f68bde74@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74
>
> Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
> ---
>  fs/gfs2/rgrp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
> index 26d6c1eea559..a879e8030568 100644
> --- a/fs/gfs2/rgrp.c
> +++ b/fs/gfs2/rgrp.c
> @@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
>         u32 bytes_left, bytes;
>         int x;
>
> -       if (!length)
> +       if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap))
>                 return -EINVAL;
>
>         rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS);
> --
> 2.34.1
>

this patch looks correct at a certain level of abstraction, but a
better approach would be to sanity check the resource group fields in
read_rindex_entry(). Andy and I are trying to work out a patch that
does that.

Thanks,
Andreas