From patchwork Fri Mar 24 20:19:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fedor Pchelkin X-Patchwork-Id: 74729 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp11695vqo; Fri, 24 Mar 2023 13:52:25 -0700 (PDT) X-Google-Smtp-Source: AKy350YHglSIDmAbe9FpOihpDW05TiuguurkrfVAMTafHOFSIqOVlgn8s4prBCMmDkHFabez8yd3 X-Received: by 2002:a17:906:3148:b0:930:fa8e:9597 with SMTP id e8-20020a170906314800b00930fa8e9597mr4025544eje.42.1679691145400; Fri, 24 Mar 2023 13:52:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1679691145; cv=none; d=google.com; s=arc-20160816; b=I5CNw5BCrvUu1J2Nba6D3rIyJFWnKxW3BgWt7KA1Bfn4SkLX2GHGQUEQ9XOp3yCgG/ 9T+XiRJiFqHg5NXZ983HFQbdHOxUma7UjD4OKUoyuVXLiIHcQ/1Itp7XV5J0wVVhPXdE QCwUV6jxSwX2VrFHOmL0UhBa8ZU0BLx3RuZyauGQPkY7n2OatEGW0QPeROYaypaWLqld x5Rqu1/psvkNr72meDYryTVFO9maD/MTt/ka+fN/mlXEWJ18gnRiJNTOE56HPoCxkS5/ y3XlURUCFe2L07C44EKJ7CV/A1LG7PDxP3le3X4iJrMTNzIVsRj5ACaCTvIDujiS+mOc w+jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature:dkim-filter; bh=QcyGJ9bDGDc2f7NKHrplRfNToMDPqANILV6S6j5wK3c=; b=MulOtzaUMcYLKuqHvHbrTQbrzZIQ7z9pITdhzcXvxkjzTsk1oJk1kXCOT85bCffI5O PZM1CEj3wH8qYbbwises+eNq2CL71I+w1XRMmvtUfUBRgyIQZdQNTN1DRb6neR2GHFo7 pC42wlaiZ3SKN4215JjT3EJ7juX7yoLk6sCQrWRdy03c2eEWY7RMfuZp99+WRoUTMfhF 1jIoggfxRDErJ6oSBQuzuA2cSs5prFR1948a5XoogbDoeirurS+J8yPrccPscEcYm3Qy 8Stcn4IKoRDp419ZxOvgmxmzeMVrFfY9xOtSRAKoSUeSoByT/Dd2CAa2YTMhmDrIua+z SrQA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=jkOh+A5l; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x17-20020aa7dad1000000b004a18f2ffb81si23132284eds.321.2023.03.24.13.52.01; Fri, 24 Mar 2023 13:52:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=jkOh+A5l; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231822AbjCXUT6 (ORCPT + 99 others); Fri, 24 Mar 2023 16:19:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59640 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231196AbjCXUTz (ORCPT ); Fri, 24 Mar 2023 16:19:55 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA2DC90; Fri, 24 Mar 2023 13:19:54 -0700 (PDT) Received: from fpc.intra.ispras.ru (unknown [10.10.165.3]) by mail.ispras.ru (Postfix) with ESMTPSA id 19C2940737A8; Fri, 24 Mar 2023 20:19:53 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 19C2940737A8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1679689193; bh=QcyGJ9bDGDc2f7NKHrplRfNToMDPqANILV6S6j5wK3c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jkOh+A5lL5MMspopUCRQe4gy24gOZk24gg0dOqh3J5xWupOWB5g5W9c1oJuframkb CKRudsDaRF0CfMq3ON7Y0JvIEXBdfwB9HVNsnQEEGgEG67vZvVmpGQpAB+4xZhvKWw iGKNsnXQA0M8+k9nR42NNtpaDCDs65R8gEyG3M6E= From: Fedor Pchelkin To: Greg Kroah-Hartman , stable@vger.kernel.org Cc: Fedor Pchelkin , Andreas Gruenbacher , cluster-devel@redhat.com, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Subject: [PATCH 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes Date: Fri, 24 Mar 2023 23:19:33 +0300 Message-Id: <20230324201933.329885-2-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230324201933.329885-1-pchelkin@ispras.ru> References: <20230324201933.329885-1-pchelkin@ispras.ru> MIME-Version: 1.0 X-Spam-Status: No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1761282457293339895?= X-GMAIL-MSGID: =?utf-8?q?1761283822400970633?= commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin --- fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) return error; kaddr = kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, void *kaddr = kmap(page); u64 dsize = i_size_read(inode); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) ip->i_depth = (u8)depth; ip->i_entries = be32_to_cpu(str->di_entries); + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode);