From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 879828494 for ; Fri, 10 Mar 2023 14:37:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E35C6C433A0; Fri, 10 Mar 2023 14:37:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678459040; bh=1zGqyJG8ApJkO8RWyEcZ1648HpJWSCOr0VwtnhruREU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=viyOMy9ElU721K6pFXyrTUPESKd9h13WRrTuzK2h07dOe+NWLiDFtpOosA5LZ+wA/ /Rs7mubii06ECYuBs894SCXYin6CwjvEyeUPLXg2H3d4ncHKEI0i1EO1oRQWdzfwVl 2vZFM/uQLqEz5EQImdcY0is15AHWWY/WbmKL9q6o= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com, Jan Kara Subject: [PATCH 5.4 229/357] udf: Detect system inodes linked into directory hierarchy Date: Fri, 10 Mar 2023 14:38:38 +0100 Message-Id: <20230310133744.875916774@linuxfoundation.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230310133733.973883071@linuxfoundation.org> References: <20230310133733.973883071@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Jan Kara commit 85a37983ec69cc9fcd188bc37c4de15ee326355a upstream. When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa. CC: stable@vger.kernel.org Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/udf/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1900,8 +1900,13 @@ struct inode *__udf_iget(struct super_bl if (!inode) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + if (!(inode->i_state & I_NEW)) { + if (UDF_I(inode)->i_hidden != hidden_inode) { + iput(inode); + return ERR_PTR(-EFSCORRUPTED); + } return inode; + } memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr)); err = udf_read_inode(inode, hidden_inode);