From nobody Fri Jul 24 22:59:04 2026 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4710F3B27FB for ; Wed, 22 Jul 2026 10:57:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717832; cv=none; b=tUoaidQ5pbLie0tvi3cZTxX1Ktv3f3BNR6y8ze1z+HxPghI0CbA+dapjiXSwYKugbx1VFiPsgwNsfUWi7p5mDRTc0CfTwKLgc53HnBKIxU61PDW26HWlFaqJcC81eZWTPgWS0i2lx5AxBMcgiWZ+aLKetezcjEqgVgjdqhAEcu8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717832; c=relaxed/simple; bh=B9+O62Qxe6H1mnJ4OChCmotqXnWYm/eK8eBsbaRkPvE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Z8TKbo4hFanNZLtiDRG8TDaBGEgjRguekh4RII8r21C3ALOg3tk178Z2um9P30kJNSmuLrIHXvAGyTAIOZcKU85NonD6vNhjsQNNXvorRJ9l9f3yabQyudjJTaaFP0sjVmnya9DC3lOsEPGnaCqni6BNKhA5ZTXGSkJg29JIXM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pTNfFEhd; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pTNfFEhd" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-cbb7926836eso1419643a12.3 for ; Wed, 22 Jul 2026 03:57:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784717830; x=1785322630; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=oL47R6uIS/ybOhrX4ZH/w0z1fyW4ymKCM6yK0jT66lI=; b=pTNfFEhdz8JtC8Qngmc7/XokLRfsi8peJ8LyDUNa2vWecEmbN+UFmeImpBXntDwkHn ova/vWYRaLirUQg4gd91MGaa7X7gm7s28IyBznv4naJDf2Iud6gqvZK0MAzGUQnZGt+4 9S6eTG/TUp5qhbzyEH1+JrUO4dlnYULNZVOZ+gQaQtRY9b01NUPk6OIojTh3pm96yEJX o9Te8OA2nf5E09sWpnQvHl+iEqmChyF+T41Byk2bBOJPPeDsF7ngb2NdXN6MR3Xdlp43 bxqSt0zRJLsRyqmwPXbECRpRwV9LCfZKL19RTNEl+k7UaHOgkt+YqSlLLzbQrDUwx++A l3Fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784717830; x=1785322630; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oL47R6uIS/ybOhrX4ZH/w0z1fyW4ymKCM6yK0jT66lI=; b=TKYkdJrntpw9OOJENr43FSxgIARUcaroFPXDOwXz5HTVCoSINSsijOTvQBLjvFQ6SD qhXCxAY07jldFu4+zUpUjS9lZ+0z3BiWbZ7m5Xhnbh7/ls9r+Zl6o+CcSzzn84d37ihT aUn6abKjEisWisF+g+vmcduqdE6860cR401YR2t8Dzv6wnajISSpp/S7NaN0E/YTVl2P BEQy3gzaKjCez+tm75H4KwNF29mW4KonDbeoAitK5J8zlv4rr4Kuwq6sG0G+968ixAxS OAdADGQPRyiUD8J7i0EdLBxRN+LqMogQ+kuqTNOPLsQuAbPyrJNMYIV51lTxP/qQt2M1 MZ/Q== X-Gm-Message-State: AOJu0YzAh4L4bJ3KYqf8UPkr4ZxqoDAf2sIRw+kXJrKQynZ48unS/Z5/ K7hRQX792mCQNBuaOWpC+TtiuGI4IawtXYHWDwZUtTDTIrCnqJJERAvb60UsWP58 X-Gm-Gg: AR+sD11rpUfSU9eASz6Vg/GzcEBMTjVza3kcAja5tRGmqKJbAO5Lw5WRgF9jbiDdQlj 7pW7yOXJX+lBWjtuPb88719U0bxhqkompX37brTd/KjSOZp+CZ9b+14VoXt3F4n6v6WljvGRZYE krXS3M/8AC0RCMtfjEUnyKiaqNPRvoWAClwaLydWnxJ59hJ55vuj123XlVOoeowqKtn+mcdrEkw UfdOL9Hl6YUCFBQuqHoHW1f5G5yRZOLdL9cGW0ScPmjpzC68kxayiXnUQOsQ0kWi56dRYuuStPi tzOi6XGjg1hwbwH+X7Bn6V6lsaZ7rGKS93pTSupQHYmF3ZkccgJa8RNPkubKOcW/FoXojtWU/SX nyohXAbauajn8/BJktqAKwL522fV853MF/paPE9AapJuHYKAHz+YbdiWzO58ZuQ9lFp9f8hq4bL CUmClJxSRYwMTpLpGQ1lkLGir6oxgLE2DYR3jy153Ff7Jbi0Wd9jxh X-Received: by 2002:a05:6a00:2e28:b0:848:5bd5:6e86 with SMTP id d2e1a72fcca58-84c29532751mr22016873b3a.53.1784717830094; Wed, 22 Jul 2026 03:57:10 -0700 (PDT) Received: from DESKTOP-L3Q0GIV.localdomain ([203.230.195.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84e17237c32sm1154781b3a.6.2026.07.22.03.57.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 03:57:09 -0700 (PDT) From: Sangho Lee To: Christoph Hellwig Cc: linux-kernel@vger.kernel.org, Sangho Lee , stable@vger.kernel.org Subject: [PATCH] freevxfs: reject invalid OLT record sizes Date: Wed, 22 Jul 2026 19:57:06 +0900 Message-ID: <20260722105706.1385095-1-kudo3228@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vxfs_read_olt() walks image-controlled Object Location Table records by adding each record's on-disk olt_size to the current cursor: oaddr +=3D fs32_to_cpu(infp, ocp->olt_size); The value is not checked before it is used. A crafted VxFS image can set a record size to zero, which prevents the cursor from advancing and leaves mount(2) spinning in the kernel. Oversized values can also move the cursor past the mapped OLT block without first rejecting the malformed image. Reject malformed OLT header and record sizes before using them. A valid header must place the first record after the header and within the mapped OLT extent. Each record must be at least large enough to contain the common record header and must fit in the remaining extent. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Sangho Lee --- fs/freevxfs/vxfs_olt.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/fs/freevxfs/vxfs_olt.c b/fs/freevxfs/vxfs_olt.c index 23f35187c289..e5fb3b86d88e 100644 --- a/fs/freevxfs/vxfs_olt.c +++ b/fs/freevxfs/vxfs_olt.c @@ -56,6 +56,7 @@ struct buffer_head *bp; struct vxfs_olt *op; char *oaddr, *eaddr; + u32 olt_size; =20 bp =3D sb_bread(sbp, vxfs_oblock(sbp, infp->vsi_oltext, bsize)); if (!bp || !bp->b_data) @@ -77,12 +78,21 @@ goto fail; } =20 - oaddr =3D bp->b_data + fs32_to_cpu(infp, op->olt_size); eaddr =3D bp->b_data + (infp->vsi_oltsize * sbp->s_blocksize); + olt_size =3D fs32_to_cpu(infp, op->olt_size); + if (olt_size < sizeof(*op) || olt_size > eaddr - bp->b_data) { + pr_notice("vxfs: invalid olt header size\n"); + goto fail; + } + oaddr =3D bp->b_data + olt_size; =20 while (oaddr < eaddr) { struct vxfs_oltcommon *ocp =3D (struct vxfs_oltcommon *)oaddr; + u32 rec_size =3D fs32_to_cpu(infp, ocp->olt_size); + + if (rec_size < sizeof(*ocp) || rec_size > eaddr - oaddr) + goto fail; =09 switch (fs32_to_cpu(infp, ocp->olt_type)) { case VXFS_OLT_FSHEAD: @@ -93,7 +103,11 @@ break; } =20 - oaddr +=3D fs32_to_cpu(infp, ocp->olt_size); + /* + * rec_size has already been checked to advance oaddr and stay + * within the mapped OLT extent. + */ + oaddr +=3D rec_size; } =20 brelse(bp); --=20 2.43.0