Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp2295511pxb; Thu, 11 Feb 2021 08:53:55 -0800 (PST) X-Google-Smtp-Source: ABdhPJzxu0w000CCoA4JjL414ZTZG1Eq4n+PPwA5gNFefPOPSv/LUt4BZnt/EW3fLY6DQBC+dDy8 X-Received: by 2002:a05:6402:5211:: with SMTP id s17mr9210623edd.312.1613062435511; Thu, 11 Feb 2021 08:53:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1613062435; cv=none; d=google.com; s=arc-20160816; b=e+bMzGe0h4HvLJ5QItR0pU3WyeZ5QKVMQu8qoiG+LmanfG6zUAjs8Hv3sezfhvCLxj 8+a2BK4q1COT0qaeiZS3eFcVDq0aHDjw3ls1gSaqWlSCTMJvaguqCZ/lr7Mxtr9rqUVu 22CnfSFSH0v53QizHQCW+xGfcEwo+2OAGItgz3HC6Rw0Vd/1JDWxf6QN0Z8cByLrZOyk n6zHLbuXSSQZIxv3pOI9GHXZK68h35yUCF1DXYJjUdW/NXjfVvJtLvi5Y9+mMs0V1SuO Xlyi7/8zNB5GDh3npa2NcCg2BaShoA/h4PbcOSDvUvgv1DaNttp9PzTqXWds2CGRqS5e 9EvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=p3x/v7abXRs0RHtbrZS0RK1Y8IlvjhjDt2EOHfKJZZg=; b=WNBP+WRK0Bh734jXDnNeF8Fevyejrk3jBltr9Mx4LbEY6FN8Hw7W3hQMXRF8aAz7sZ P6/Cn6BYAkBLH45uwu7ZX2lhrYdJFq1qbbpaha7eY4YbyS3am/uqzfBQisBKMC7SOxrT Y7+cGc2PiALJbeboGXUqtMaT2pw+HnQwd756xdpNHSVl8iyQWX8smKeZdKBZ/bOxcwb5 bPf+6e1Hi6cpTXp5xnElOvsYH6gtA7AQxOiyCugeeCseWVs2DnFD8hhnsAVCXMffFa9/ b6gFhA+DHX15srw3v0x/1Akfo+HYHxLEkZZlyNHzdNxyY0HQZJoztKtnpl8yceK8I4dn 3uwQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=v7l7lBA4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id w4si3863154ejz.337.2021.02.11.08.53.31; Thu, 11 Feb 2021 08:53:55 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=v7l7lBA4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232085AbhBKQtv (ORCPT + 99 others); Thu, 11 Feb 2021 11:49:51 -0500 Received: from mail.kernel.org ([198.145.29.99]:57472 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229991AbhBKPjl (ORCPT ); Thu, 11 Feb 2021 10:39:41 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 15CD764EFA; Thu, 11 Feb 2021 15:05:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1613055908; bh=rmkHtqdHOAADIqXZNJsn2jznTd52r0jqSpRSJ7qc+mI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v7l7lBA4zoxfke2mm1B43ati2b3jr9XHBAGprDUW2NOqe+F41gfEmnjhd9u2JPUqF f1WmpLHb6QetM1HK11Rv326GLv+xRgDtfBK0XAZq72WgJBMTb8HA/SFsY+FaO9L6Ft lTqK9g8FPeyBZYFKbnql9DUDlWRWFKDE06TZE+E8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Phillip Lougher , syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com, Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 54/54] squashfs: add more sanity checks in xattr id lookup Date: Thu, 11 Feb 2021 16:02:38 +0100 Message-Id: <20210211150155.219688580@linuxfoundation.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210211150152.885701259@linuxfoundation.org> References: <20210211150152.885701259@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Phillip Lougher commit 506220d2ba21791314af569211ffd8870b8208fa upstream. Sysbot has reported a warning where a kmalloc() attempt exceeds the maximum limit. This has been identified as corruption of the xattr_ids count when reading the xattr id lookup table. This patch adds a number of additional sanity checks to detect this corruption and others. 1. It checks for a corrupted xattr index read from the inode. This could be because the metadata block is uncompressed, or because the "compression" bit has been corrupted (turning a compressed block into an uncompressed block). This would cause an out of bounds read. 2. It checks against corruption of the xattr_ids count. This can either lead to the above kmalloc failure, or a smaller than expected table to be read. 3. It checks the contents of the index table for corruption. [phillip@squashfs.org.uk: fix checkpatch issue] Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher Reported-by: syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/squashfs/xattr_id.c | 66 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 57 insertions(+), 9 deletions(-) --- a/fs/squashfs/xattr_id.c +++ b/fs/squashfs/xattr_id.c @@ -31,10 +31,15 @@ int squashfs_xattr_lookup(struct super_b struct squashfs_sb_info *msblk = sb->s_fs_info; int block = SQUASHFS_XATTR_BLOCK(index); int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index); - u64 start_block = le64_to_cpu(msblk->xattr_id_table[block]); + u64 start_block; struct squashfs_xattr_id id; int err; + if (index >= msblk->xattr_ids) + return -EINVAL; + + start_block = le64_to_cpu(msblk->xattr_id_table[block]); + err = squashfs_read_metadata(sb, &id, &start_block, &offset, sizeof(id)); if (err < 0) @@ -50,13 +55,17 @@ int squashfs_xattr_lookup(struct super_b /* * Read uncompressed xattr id lookup table indexes from disk into memory */ -__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start, +__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, u64 *xattr_table_start, int *xattr_ids) { - unsigned int len; + struct squashfs_sb_info *msblk = sb->s_fs_info; + unsigned int len, indexes; struct squashfs_xattr_id_table *id_table; + __le64 *table; + u64 start, end; + int n; - id_table = squashfs_read_table(sb, start, sizeof(*id_table)); + id_table = squashfs_read_table(sb, table_start, sizeof(*id_table)); if (IS_ERR(id_table)) return (__le64 *) id_table; @@ -70,13 +79,52 @@ __le64 *squashfs_read_xattr_id_table(str if (*xattr_ids == 0) return ERR_PTR(-EINVAL); - /* xattr_table should be less than start */ - if (*xattr_table_start >= start) + len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); + indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids); + + /* + * The computed size of the index table (len bytes) should exactly + * match the table start and end points + */ + start = table_start + sizeof(*id_table); + end = msblk->bytes_used; + + if (len != (end - start)) return ERR_PTR(-EINVAL); - len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); + table = squashfs_read_table(sb, start, len); + if (IS_ERR(table)) + return table; + + /* table[0], table[1], ... table[indexes - 1] store the locations + * of the compressed xattr id blocks. Each entry should be less than + * the next (i.e. table[0] < table[1]), and the difference between them + * should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1] + * should be less than table_start, and again the difference + * shouls be SQUASHFS_METADATA_SIZE or less. + * + * Finally xattr_table_start should be less than table[0]. + */ + for (n = 0; n < (indexes - 1); n++) { + start = le64_to_cpu(table[n]); + end = le64_to_cpu(table[n + 1]); + + if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { + kfree(table); + return ERR_PTR(-EINVAL); + } + } + + start = le64_to_cpu(table[indexes - 1]); + if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) { + kfree(table); + return ERR_PTR(-EINVAL); + } - TRACE("In read_xattr_index_table, length %d\n", len); + if (*xattr_table_start >= le64_to_cpu(table[0])) { + kfree(table); + return ERR_PTR(-EINVAL); + } - return squashfs_read_table(sb, start + sizeof(*id_table), len); + return table; }