mirror of
https://github.com/torvalds/linux.git
synced 2024-11-18 01:51:53 +00:00
506220d2ba
Sysbot has reported a warning where a kmalloc() attempt exceeds the maximum limit. This has been identified as corruption of the xattr_ids count when reading the xattr id lookup table. This patch adds a number of additional sanity checks to detect this corruption and others. 1. It checks for a corrupted xattr index read from the inode. This could be because the metadata block is uncompressed, or because the "compression" bit has been corrupted (turning a compressed block into an uncompressed block). This would cause an out of bounds read. 2. It checks against corruption of the xattr_ids count. This can either lead to the above kmalloc failure, or a smaller than expected table to be read. 3. It checks the contents of the index table for corruption. [phillip@squashfs.org.uk: fix checkpatch issue] Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Reported-by: syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
131 lines
3.3 KiB
C
131 lines
3.3 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Squashfs - a compressed read only filesystem for Linux
|
|
*
|
|
* Copyright (c) 2010
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* xattr_id.c
|
|
*/
|
|
|
|
/*
|
|
* This file implements code to map the 32-bit xattr id stored in the inode
|
|
* into the on disk location of the xattr data.
|
|
*/
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/vfs.h>
|
|
#include <linux/slab.h>
|
|
|
|
#include "squashfs_fs.h"
|
|
#include "squashfs_fs_sb.h"
|
|
#include "squashfs.h"
|
|
#include "xattr.h"
|
|
|
|
/*
|
|
* Map xattr id using the xattr id look up table
|
|
*/
|
|
int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
|
|
int *count, unsigned int *size, unsigned long long *xattr)
|
|
{
|
|
struct squashfs_sb_info *msblk = sb->s_fs_info;
|
|
int block = SQUASHFS_XATTR_BLOCK(index);
|
|
int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index);
|
|
u64 start_block;
|
|
struct squashfs_xattr_id id;
|
|
int err;
|
|
|
|
if (index >= msblk->xattr_ids)
|
|
return -EINVAL;
|
|
|
|
start_block = le64_to_cpu(msblk->xattr_id_table[block]);
|
|
|
|
err = squashfs_read_metadata(sb, &id, &start_block, &offset,
|
|
sizeof(id));
|
|
if (err < 0)
|
|
return err;
|
|
|
|
*xattr = le64_to_cpu(id.xattr);
|
|
*size = le32_to_cpu(id.size);
|
|
*count = le32_to_cpu(id.count);
|
|
return 0;
|
|
}
|
|
|
|
|
|
/*
|
|
* Read uncompressed xattr id lookup table indexes from disk into memory
|
|
*/
|
|
__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
|
|
u64 *xattr_table_start, int *xattr_ids)
|
|
{
|
|
struct squashfs_sb_info *msblk = sb->s_fs_info;
|
|
unsigned int len, indexes;
|
|
struct squashfs_xattr_id_table *id_table;
|
|
__le64 *table;
|
|
u64 start, end;
|
|
int n;
|
|
|
|
id_table = squashfs_read_table(sb, table_start, sizeof(*id_table));
|
|
if (IS_ERR(id_table))
|
|
return (__le64 *) id_table;
|
|
|
|
*xattr_table_start = le64_to_cpu(id_table->xattr_table_start);
|
|
*xattr_ids = le32_to_cpu(id_table->xattr_ids);
|
|
kfree(id_table);
|
|
|
|
/* Sanity check values */
|
|
|
|
/* there is always at least one xattr id */
|
|
if (*xattr_ids == 0)
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
|
|
indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
|
|
|
|
/*
|
|
* The computed size of the index table (len bytes) should exactly
|
|
* match the table start and end points
|
|
*/
|
|
start = table_start + sizeof(*id_table);
|
|
end = msblk->bytes_used;
|
|
|
|
if (len != (end - start))
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
table = squashfs_read_table(sb, start, len);
|
|
if (IS_ERR(table))
|
|
return table;
|
|
|
|
/* table[0], table[1], ... table[indexes - 1] store the locations
|
|
* of the compressed xattr id blocks. Each entry should be less than
|
|
* the next (i.e. table[0] < table[1]), and the difference between them
|
|
* should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1]
|
|
* should be less than table_start, and again the difference
|
|
* shouls be SQUASHFS_METADATA_SIZE or less.
|
|
*
|
|
* Finally xattr_table_start should be less than table[0].
|
|
*/
|
|
for (n = 0; n < (indexes - 1); n++) {
|
|
start = le64_to_cpu(table[n]);
|
|
end = le64_to_cpu(table[n + 1]);
|
|
|
|
if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
|
|
kfree(table);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
}
|
|
|
|
start = le64_to_cpu(table[indexes - 1]);
|
|
if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
|
|
kfree(table);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
|
|
if (*xattr_table_start >= le64_to_cpu(table[0])) {
|
|
kfree(table);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
|
|
return table;
|
|
}
|