Received-SPF: pass (google.com: domain of linux-kernel+bounces-174825-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Thu, 9 May 2024 15:32:18 -0400
From: Kent Overstreet <kent.overstreet@linux.dev>
To: Camila Alvarez <cam.alvarez.i@gmail.com>
Cc: Brian Foster <bfoster@redhat.com>, linux-bcachefs@vger.kernel.org, 
	linux-kernel@vger.kernel.org, syzbot+9833a1d29d4a44361e2c@syzkaller.appspotmail.com
Subject: Re: [PATCH] bcachefs: guard against invalid bits_per_field in
 bch2_bkey_format_invalid
Message-ID: <ygq5bsdf4suuqp3sfa4lj5ko6afk3kbhtyuo6e6fe6eiwr2uv5@u3igdwmfaful>
References: <20240509014030.671222-1-cam.alvarez.i@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240509014030.671222-1-cam.alvarez.i@gmail.com>

On Wed, May 08, 2024 at 09:40:32PM -0400, Camila Alvarez wrote:
> A check for a valid value for bits_per_field is performed for each field before computing packed_max.
> If bits_per_field is invalid for any field the whole format is deemed
> invalid.
> 
> Reported-by: syzbot+9833a1d29d4a44361e2c@syzkaller.appspotmail.com
> Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
> ---
>  fs/bcachefs/bcachefs_format.h |  8 ++++++++
>  fs/bcachefs/bkey.c            | 18 ++++++++++++++++--
>  2 files changed, 24 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/bcachefs/bcachefs_format.h b/fs/bcachefs/bcachefs_format.h
> index d5b90439e581..9e688a8d780f 100644
> --- a/fs/bcachefs/bcachefs_format.h
> +++ b/fs/bcachefs/bcachefs_format.h
> @@ -318,6 +318,14 @@ enum bch_bkey_fields {
>  #define bkey_format_field(name, field)					\
>  	[BKEY_FIELD_##name] = (sizeof(((struct bkey *) NULL)->field) * 8)
>  
> +#define BCH_BKEY_FIELDS()						\
> +	x(INODE,        p.inode)					\
> +	x(OFFSET,       p.offset)					\
> +	x(SNAPSHOT,     p.snapshot)					\
> +	x(SIZE,         size)						\
> +	x(VERSION_HI,   version.hi)					\
> +	x(VERSION_LO,   version.lo)	
> +
>  #define BKEY_FORMAT_CURRENT						\
>  ((struct bkey_format) {							\
>  	.key_u64s	= BKEY_U64s,					\
> diff --git a/fs/bcachefs/bkey.c b/fs/bcachefs/bkey.c
> index 76e79a15ba08..f7847c96a105 100644
> --- a/fs/bcachefs/bkey.c
> +++ b/fs/bcachefs/bkey.c
> @@ -638,6 +638,13 @@ struct bkey_format bch2_bkey_format_done(struct bkey_format_state *s)
>  	return ret;
>  }
>  
> +static unsigned bch2_max_bits_per_field[] = {
> +#define x(name, field) \
> +	bkey_format_field(name, field),
> +	BCH_BKEY_FIELDS()
> +#undef x
> +};
> +
>  int bch2_bkey_format_invalid(struct bch_fs *c,
>  			     struct bkey_format *f,
>  			     enum bkey_invalid_flags flags,
> @@ -659,8 +666,15 @@ int bch2_bkey_format_invalid(struct bch_fs *c,
>  		if (!c || c->sb.version_min >= bcachefs_metadata_version_snapshot) {
>  			unsigned unpacked_bits = bch2_bkey_format_current.bits_per_field[i];
>  			u64 unpacked_max = ~((~0ULL << 1) << (unpacked_bits - 1));
> -			u64 packed_max = f->bits_per_field[i]
> -				? ~((~0ULL << 1) << (f->bits_per_field[i] - 1))
> +			unsigned bits_per_field = f->bits_per_field[i];
> +
> +			if (bits_per_field > bch2_max_bits_per_field[i]) {
> +				prt_printf(err, "field %u uses more bits than allowed: %u > %u",
> +						i, bits_per_field, bch2_max_bits_per_field[i]);
> +				return -BCH_ERR_invalid;
> +			}
> +			u64 packed_max = bits_per_field
> +				? ~((~0ULL << 1) << (bits_per_field - 1))
>  				: 0;
>  			u64 field_offset = le64_to_cpu(f->field_offset[i]);
>  
> -- 
> 2.34.1
> 

Already applied this patch:

commit 61692c7812ab2aca17a3751f6e7798acbdae4b6b
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Wed May 8 10:58:26 2024 -0400

    bcachefs: bch2_bkey_format_field_overflows()
    
    Fix another shift-by-64 by factoring out a common helper for
    bch2_bkey_format_invalid() and bformat_needs_redo() (where it was
    already fixed).
    
    Reported-by: syzbot+9833a1d29d4a44361e2c@syzkaller.appspotmail.com
    Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/bkey.c b/fs/bcachefs/bkey.c
index 76e79a15ba08..952299a2e416 100644
--- a/fs/bcachefs/bkey.c
+++ b/fs/bcachefs/bkey.c
@@ -656,20 +656,17 @@ int bch2_bkey_format_invalid(struct bch_fs *c,
 	 * unpacked format:
 	 */
 	for (i = 0; i < f->nr_fields; i++) {
-		if (!c || c->sb.version_min >= bcachefs_metadata_version_snapshot) {
+		if ((!c || c->sb.version_min >= bcachefs_metadata_version_snapshot) &&
+		    bch2_bkey_format_field_overflows(f, i)) {
 			unsigned unpacked_bits = bch2_bkey_format_current.bits_per_field[i];
 			u64 unpacked_max = ~((~0ULL << 1) << (unpacked_bits - 1));
 			u64 packed_max = f->bits_per_field[i]
 				? ~((~0ULL << 1) << (f->bits_per_field[i] - 1))
 				: 0;
-			u64 field_offset = le64_to_cpu(f->field_offset[i]);
 
-			if (packed_max + field_offset < packed_max ||
-			    packed_max + field_offset > unpacked_max) {
-				prt_printf(err, "field %u too large: %llu + %llu > %llu",
-					   i, packed_max, field_offset, unpacked_max);
-				return -BCH_ERR_invalid;
-			}
+			prt_printf(err, "field %u too large: %llu + %llu > %llu",
+				   i, packed_max, le64_to_cpu(f->field_offset[i]), unpacked_max);
+			return -BCH_ERR_invalid;
 		}
 
 		bits += f->bits_per_field[i];
diff --git a/fs/bcachefs/bkey.h b/fs/bcachefs/bkey.h
index 3a45d128f608..1bb0bd4371b0 100644
--- a/fs/bcachefs/bkey.h
+++ b/fs/bcachefs/bkey.h
@@ -574,6 +574,29 @@ static inline void bch2_bkey_format_add_key(struct bkey_format_state *s, const s
 
 void bch2_bkey_format_add_pos(struct bkey_format_state *, struct bpos);
 struct bkey_format bch2_bkey_format_done(struct bkey_format_state *);
+
+static inline bool bch2_bkey_format_field_overflows(struct bkey_format *f, unsigned i)
+{
+	unsigned f_bits = f->bits_per_field[i];
+	unsigned unpacked_bits = bch2_bkey_format_current.bits_per_field[i];
+	u64 unpacked_mask = ~((~0ULL << 1) << (unpacked_bits - 1));
+	u64 field_offset = le64_to_cpu(f->field_offset[i]);
+
+	if (f_bits > unpacked_bits)
+		return true;
+
+	if ((f_bits == unpacked_bits) && field_offset)
+		return true;
+
+	u64 f_mask = f_bits
+		? ~((~0ULL << (f_bits - 1)) << 1)
+		: 0;
+
+	if (((field_offset + f_mask) & unpacked_mask) < field_offset)
+		return true;
+	return false;
+}
+
 int bch2_bkey_format_invalid(struct bch_fs *, struct bkey_format *,
 			     enum bkey_invalid_flags, struct printbuf *);
 void bch2_bkey_format_to_text(struct printbuf *, const struct bkey_format *);
diff --git a/fs/bcachefs/move.c b/fs/bcachefs/move.c
index 4d94b7742dbb..45984a688e5b 100644
--- a/fs/bcachefs/move.c
+++ b/fs/bcachefs/move.c
@@ -975,26 +975,10 @@ static bool migrate_btree_pred(struct bch_fs *c, void *arg,
  */
 static bool bformat_needs_redo(struct bkey_format *f)
 {
-	for (unsigned i = 0; i < f->nr_fields; i++) {
-		unsigned f_bits = f->bits_per_field[i];
-		unsigned unpacked_bits = bch2_bkey_format_current.bits_per_field[i];
-		u64 unpacked_mask = ~((~0ULL << 1) << (unpacked_bits - 1));
-		u64 field_offset = le64_to_cpu(f->field_offset[i]);
-
-		if (f_bits > unpacked_bits)
-			return true;
-
-		if ((f_bits == unpacked_bits) && field_offset)
+	for (unsigned i = 0; i < f->nr_fields; i++)
+		if (bch2_bkey_format_field_overflows(f, i))
 			return true;
 
-		u64 f_mask = f_bits
-			? ~((~0ULL << (f_bits - 1)) << 1)
-			: 0;
-
-		if (((field_offset + f_mask) & unpacked_mask) < field_offset)
-			return true;
-	}
-
 	return false;
 }