From patchwork Mon Apr 10 17:37:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Xiang X-Patchwork-Id: 81580 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp2055221vqo; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) X-Google-Smtp-Source: AKy350ZZYG0CtsEXHlgROclTE4pLalhYmgqMaDScM0IY/bW+Gfr5Rp5h6OLfY8PtTvzP2y5au5f+ X-Received: by 2002:aa7:c691:0:b0:4fb:78a0:eabe with SMTP id n17-20020aa7c691000000b004fb78a0eabemr7086141edq.14.1681149250250; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681149250; cv=none; d=google.com; s=arc-20160816; b=SmXdu26JfaYjm5AkWFZNW+GlRWatFPCAllr57jM4QKk+7XUboqr7QbtjHSbzOBoY30 6hhuN2ptnH1Fz4xwHVqZDRVhmmJIQIUh/WdYM5hovkwBY40T/bKZnfH3m1QT8AFGz6Bz iRyPl5GFXs33heaJrFWk+qCsb5GSJ5d2WW9tMHN8tOGESeGXCmFkVcNWhNO0BudeEpBp 1hWrlwq0eM5ERKf7BfgcVS79WOKEK0ertSqmS2FX2g8NJjk8J5nna1hSd7aop/G3llsc 0iQSsyHiKtfnmATCcbtEHHeQIlfxCZK02txc7rvoV4GRwzRjPXup4vTOYhgGbyJ3vrKj KHsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=WG2zIQyFHkcl2ar1PLw3rMI/GdFkiKxBY9q8AABjsYs=; b=SLJm56JCL0EUv4AJt23p9HSvedP/USHTP5qZOdXzZSTTCRTLlvFnh4MQ8Qw3PSWGa2 0ldkkSO7+tEkWdaJVg7K4mI+xutIm7prQ4JELYP5sInWIIon/kTsLwNY9ck1nfD5dHs9 ZzgjwYbCxBME7x7F4GSpYZbaBQUsgF5ne8/goaQ/toRG06OUiIzKwwEqnWJ4Uaa1L5Yc dN9uJ+zNmOQp/5oiTn693lUJC+ixvORtso8j1pYTl3Sd2eaYbGKYq+i7vgbrXbEF/yoC 7ZRmgnnhzIb3KUZGR5sM8IwQyVxez55X/+cgFg3J9vYbrlhrxlHRvezD92d8UigwpGfA Avpg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p1-20020a056402044100b005049b859721si3665495edw.49.2023.04.10.10.53.46; Mon, 10 Apr 2023 10:54:10 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229645AbjDJRhh (ORCPT + 99 others); Mon, 10 Apr 2023 13:37:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230283AbjDJRhd (ORCPT ); Mon, 10 Apr 2023 13:37:33 -0400 Received: from out30-97.freemail.mail.aliyun.com (out30-97.freemail.mail.aliyun.com [115.124.30.97]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2C7F10DB for ; Mon, 10 Apr 2023 10:37:31 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R131e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046056;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=4;SR=0;TI=SMTPD_---0Vfovcdl_1681148235; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0Vfovcdl_1681148235) by smtp.aliyun-inc.com; Tue, 11 Apr 2023 01:37:28 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org Cc: LKML , Gao Xiang , syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com Subject: [PATCH] erofs: stop parsing non-compact HEAD index if clusterofs is invalid Date: Tue, 11 Apr 2023 01:37:14 +0800 Message-Id: <20230410173714.104604-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 MIME-Version: 1.0 X-Spam-Status: No, score=-8.0 required=5.0 tests=ENV_AND_HDR_SPF_MATCH, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY, USER_IN_DEF_SPF_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1762812756312571429?= X-GMAIL-MSGID: =?utf-8?q?1762812756312571429?= Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below: BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30 Note that normal images or images using compact indexes are not impacted. Let's fix this now. [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com Reported-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang Reviewed-by: Chao Yu --- fs/erofs/zmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index cbd3f72c83e9..7ca108c3834c 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -85,6 +85,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, if (advise & Z_EROFS_LI_PARTIAL_REF) m->partialref = true; m->clusterofs = le16_to_cpu(di->di_clusterofs); + if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { + DBG_BUGON(1); + return -EFSCORRUPTED; + } m->pblk = le32_to_cpu(di->di_u.blkaddr); break; default: