[f2fs-dev] [PATCH 1/2] fsck.f2fs: sanity check i_inline_xattr_size correctly

[f2fs-dev] [PATCH 1/2] fsck.f2fs: sanity check i_inline_xattr_size correctly

[Chao Yu via Linux-f2fs-devel]

Corrupted inode may contain invalid i_inline_xattr_size field, when
F2FS_FEATURE_FLEXIBLE_INLINE_XATTR is enabled, and inode has not
F2FS_INLINE_XATTR flag, fsck.f2fs won't check its validation, however
we will still use i_inline_xattr_size field via get_inline_xattr_addrs(),
it may cause potential heap buffer underflows and out-of-bound read/write.

In addition, we missed to check i_inline_xattr_size w/ lower boundary
MIN_INLINE_XATTR_SIZE like we did in kernel side.

This patch fixes above two issues.

Signed-off-by: Chao Yu <chao@kernel.org>
---
 fsck/fsck.c  | 10 ++++++----
 fsck/xattr.h |  2 ++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/fsck/fsck.c b/fsck/fsck.c
index 4fca4dd..e679357 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -1063,14 +1063,16 @@ check_next:
 			}
 		}
 
-		if ((c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) &&
-			(node_blk->i.i_inline & F2FS_INLINE_XATTR)) {
+		if (c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) {
 			unsigned int inline_size =
 				le16_to_cpu(node_blk->i.i_inline_xattr_size);
 
 			if (time_to_inject(FAULT_INODE) ||
-					(!inline_size ||
-					inline_size > MAX_INLINE_XATTR_SIZE)) {
+					inline_size > MAX_INLINE_XATTR_SIZE ||
+					(inline_size != 0 &&
+					 inline_size < MIN_INLINE_XATTR_SIZE) ||
+					((node_blk->i.i_inline & F2FS_INLINE_XATTR) &&
+					 !inline_size)) {
 				ASSERT_MSG("[0x%x] wrong inline_xattr_size:%u",
 						nid, inline_size);
 				if (c.fix_on) {
diff --git a/fsck/xattr.h b/fsck/xattr.h
index 867349c..5f59e8e 100644
--- a/fsck/xattr.h
+++ b/fsck/xattr.h
@@ -200,4 +200,6 @@ static inline int f2fs_acl_count(int size)
 			F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) -	\
 			DEF_INLINE_RESERVED_SIZE -			\
 			MIN_INLINE_DENTRY_SIZE / sizeof(__le32))
+#define MIN_INLINE_XATTR_SIZE						\
+			(sizeof(struct f2fs_xattr_header) / sizeof(__le32))
 #endif
-- 
2.49.0



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

[f2fs-dev] [PATCH 2/2] fsck.f2fs: add bounds checking for orphan entry_count

[Chao Yu via Linux-f2fs-devel]

In fsck_chk_orphan_node(), entry_count is read directly from the on-disk
orphan block footer. If an attacker or corrupted filesystem sets this to an
excessive value (e.g., 0xFFFFFFFF), it can cause a massive loop leading to
out-of-bounds memory reads and out-of-bounds writes into the newly allocated
orphan repair block.

Fix this by ensuring entry_count does not exceed F2FS_ORPHANS_PER_BLOCK. If
an invalid entry_count is encountered, safely reset it to 0 and write the
repaired orphan block to disk when running with auto-fix enabled.

Signed-off-by: Chao Yu <chao@kernel.org>
---
 fsck/fsck.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fsck/fsck.c b/fsck/fsck.c
index e679357..66cc1c5 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -2275,6 +2275,17 @@ int fsck_chk_orphan_node(struct f2fs_sb_info *sbi)
 
 		ASSERT(ret >= 0);
 		entry_count = le32_to_cpu(F2FS_ORPHAN_BLOCK_FOOTER(orphan_blk)->entry_count);
+		if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+			ASSERT_MSG("wrong orphan entry_count: %u", entry_count);
+			entry_count = 0;
+			if (f2fs_dev_is_writable() && c.fix_on) {
+				FIX_MSG("reset orphan entry_count to 0");
+				F2FS_ORPHAN_BLOCK_FOOTER(new_blk)->entry_count = 0;
+				ret = dev_write_block(new_blk, start_blk + i,
+						      WRITE_LIFE_NONE);
+				ASSERT(ret >= 0);
+			}
+		}
 
 		for (j = 0; j < entry_count; j++) {
 			nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
-- 
2.49.0



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel