Message ID | 20230410173714.104604-1-hsiangkao@linux.alibaba.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp2055221vqo; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) X-Google-Smtp-Source: AKy350ZZYG0CtsEXHlgROclTE4pLalhYmgqMaDScM0IY/bW+Gfr5Rp5h6OLfY8PtTvzP2y5au5f+ X-Received: by 2002:aa7:c691:0:b0:4fb:78a0:eabe with SMTP id n17-20020aa7c691000000b004fb78a0eabemr7086141edq.14.1681149250250; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681149250; cv=none; d=google.com; s=arc-20160816; b=SmXdu26JfaYjm5AkWFZNW+GlRWatFPCAllr57jM4QKk+7XUboqr7QbtjHSbzOBoY30 6hhuN2ptnH1Fz4xwHVqZDRVhmmJIQIUh/WdYM5hovkwBY40T/bKZnfH3m1QT8AFGz6Bz iRyPl5GFXs33heaJrFWk+qCsb5GSJ5d2WW9tMHN8tOGESeGXCmFkVcNWhNO0BudeEpBp 1hWrlwq0eM5ERKf7BfgcVS79WOKEK0ertSqmS2FX2g8NJjk8J5nna1hSd7aop/G3llsc 0iQSsyHiKtfnmATCcbtEHHeQIlfxCZK02txc7rvoV4GRwzRjPXup4vTOYhgGbyJ3vrKj KHsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=WG2zIQyFHkcl2ar1PLw3rMI/GdFkiKxBY9q8AABjsYs=; b=SLJm56JCL0EUv4AJt23p9HSvedP/USHTP5qZOdXzZSTTCRTLlvFnh4MQ8Qw3PSWGa2 0ldkkSO7+tEkWdaJVg7K4mI+xutIm7prQ4JELYP5sInWIIon/kTsLwNY9ck1nfD5dHs9 ZzgjwYbCxBME7x7F4GSpYZbaBQUsgF5ne8/goaQ/toRG06OUiIzKwwEqnWJ4Uaa1L5Yc dN9uJ+zNmOQp/5oiTn693lUJC+ixvORtso8j1pYTl3Sd2eaYbGKYq+i7vgbrXbEF/yoC 7ZRmgnnhzIb3KUZGR5sM8IwQyVxez55X/+cgFg3J9vYbrlhrxlHRvezD92d8UigwpGfA Avpg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p1-20020a056402044100b005049b859721si3665495edw.49.2023.04.10.10.53.46; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229645AbjDJRhh (ORCPT <rfc822;yuanzuo1009@gmail.com> + 99 others); Mon, 10 Apr 2023 13:37:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230283AbjDJRhd (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 10 Apr 2023 13:37:33 -0400 Received: from out30-97.freemail.mail.aliyun.com (out30-97.freemail.mail.aliyun.com [115.124.30.97]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2C7F10DB for <linux-kernel@vger.kernel.org>; Mon, 10 Apr 2023 10:37:31 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R131e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046056;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=4;SR=0;TI=SMTPD_---0Vfovcdl_1681148235; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0Vfovcdl_1681148235) by smtp.aliyun-inc.com; Tue, 11 Apr 2023 01:37:28 +0800 From: Gao Xiang <hsiangkao@linux.alibaba.com> To: linux-erofs@lists.ozlabs.org Cc: LKML <linux-kernel@vger.kernel.org>, Gao Xiang <hsiangkao@linux.alibaba.com>, syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com Subject: [PATCH] erofs: stop parsing non-compact HEAD index if clusterofs is invalid Date: Tue, 11 Apr 2023 01:37:14 +0800 Message-Id: <20230410173714.104604-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-8.0 required=5.0 tests=ENV_AND_HDR_SPF_MATCH, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY, USER_IN_DEF_SPF_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1762812756312571429?= X-GMAIL-MSGID: =?utf-8?q?1762812756312571429?= |
Series |
erofs: stop parsing non-compact HEAD index if clusterofs is invalid
|
|
Commit Message
Gao Xiang
April 10, 2023, 5:37 p.m. UTC
Syzbot generated a crafted image [1] with a non-compact HEAD index of
clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
which causes the following unexpected behavior as below:
BUG: unable to handle page fault for address: fffff52101a3fff9
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffed067 P4D 23ffed067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Workqueue: erofs_worker z_erofs_decompressqueue_work
RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
...
Call Trace:
<TASK>
z_erofs_decompressqueue_work+0x99/0xe0
process_one_work+0x8f6/0x1170
worker_thread+0xa63/0x1210
kthread+0x270/0x300
ret_from_fork+0x1f/0x30
Note that normal images or images using compact indexes are not
impacted. Let's fix this now.
[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
Reported-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com
Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter")
Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
fs/erofs/zmap.c | 4 ++++
1 file changed, 4 insertions(+)
Comments
On 2023/4/11 1:37, Gao Xiang wrote: > Syzbot generated a crafted image [1] with a non-compact HEAD index of > clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, > which causes the following unexpected behavior as below: > > BUG: unable to handle page fault for address: fffff52101a3fff9 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 23ffed067 P4D 23ffed067 PUD 0 > Oops: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 > Workqueue: erofs_worker z_erofs_decompressqueue_work > RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 > ... > Call Trace: > <TASK> > z_erofs_decompressqueue_work+0x99/0xe0 > process_one_work+0x8f6/0x1170 > worker_thread+0xa63/0x1210 > kthread+0x270/0x300 > ret_from_fork+0x1f/0x30 > > Note that normal images or images using compact indexes are not > impacted. Let's fix this now. > > [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com > > Reported-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com > Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") > Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") > Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by: Chao Yu <chao@kernel.org> Thanks,
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index cbd3f72c83e9..7ca108c3834c 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -85,6 +85,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, if (advise & Z_EROFS_LI_PARTIAL_REF) m->partialref = true; m->clusterofs = le16_to_cpu(di->di_clusterofs); + if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { + DBG_BUGON(1); + return -EFSCORRUPTED; + } m->pblk = le32_to_cpu(di->di_u.blkaddr); break; default: