[f2fs-dev] [PATCH 1/2] fsck.f2fs: sanity check i_inline_xattr_size correctly

[Chao Yu via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>]

Corrupted inode may contain invalid i_inline_xattr_size field, when
F2FS_FEATURE_FLEXIBLE_INLINE_XATTR is enabled, and inode has not
F2FS_INLINE_XATTR flag, fsck.f2fs won't check its validation, however
we will still use i_inline_xattr_size field via get_inline_xattr_addrs(),
it may cause potential heap buffer underflows and out-of-bound read/write.

In addition, we missed to check i_inline_xattr_size w/ lower boundary
MIN_INLINE_XATTR_SIZE like we did in kernel side.

This patch fixes above two issues.

Signed-off-by: Chao Yu <chao@kernel.org>
---
 fsck/fsck.c  | 10 ++++++----
 fsck/xattr.h |  2 ++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/fsck/fsck.c b/fsck/fsck.c
index 4fca4dd..e679357 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -1063,14 +1063,16 @@ check_next:
 			}
 		}
 
-		if ((c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) &&
-			(node_blk->i.i_inline & F2FS_INLINE_XATTR)) {
+		if (c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) {
 			unsigned int inline_size =
 				le16_to_cpu(node_blk->i.i_inline_xattr_size);
 
 			if (time_to_inject(FAULT_INODE) ||
-					(!inline_size ||
-					inline_size > MAX_INLINE_XATTR_SIZE)) {
+					inline_size > MAX_INLINE_XATTR_SIZE ||
+					(inline_size != 0 &&
+					 inline_size < MIN_INLINE_XATTR_SIZE) ||
+					((node_blk->i.i_inline & F2FS_INLINE_XATTR) &&
+					 !inline_size)) {
 				ASSERT_MSG("[0x%x] wrong inline_xattr_size:%u",
 						nid, inline_size);
 				if (c.fix_on) {
diff --git a/fsck/xattr.h b/fsck/xattr.h
index 867349c..5f59e8e 100644
--- a/fsck/xattr.h
+++ b/fsck/xattr.h
@@ -200,4 +200,6 @@ static inline int f2fs_acl_count(int size)
 			F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) -	\
 			DEF_INLINE_RESERVED_SIZE -			\
 			MIN_INLINE_DENTRY_SIZE / sizeof(__le32))
+#define MIN_INLINE_XATTR_SIZE						\
+			(sizeof(struct f2fs_xattr_header) / sizeof(__le32))
 #endif
-- 
2.49.0



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel