[f2fs-dev] [PATCH 2/3] fsck.f2fs: sanity check i_extra_isize correctly

[Chao Yu via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>]

In fsck_chk_inode_blk(), fsck.f2fs checks whether i_extra_isize is
larger than 4 * DEF_ADDRS_PER_INODE. However, this upper threshold is
too loose and fails to check the lower boundary or 4-byte alignment.

When an inode has a corrupted i_extra_isize (e.g. 3692), it bypasses
the sanity check. Subsequent calculation in addrs_per_page() causes an
unsigned integer underflow (CUR_ADDRS_PER_INODE - get_inline_xattr_addrs),
resulting in a huge loop bound in fsck_chk_inode_blk() and out-of-bounds
heap reads and writes.

This patch fixes the issue by:
1. Defining F2FS_MIN_EXTRA_ATTR_SIZE in include/f2fs_fs.h.
2. Checking i_extra_isize against F2FS_MIN_EXTRA_ATTR_SIZE,
   F2FS_TOTAL_EXTRA_ATTR_SIZE, and 4-byte alignment, matching the
   kernel-side sanity_check_inode() logic.

Signed-off-by: Chao Yu <chao@kernel.org>
---
 fsck/fsck.c       | 4 +++-
 include/f2fs_fs.h | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/fsck/fsck.c b/fsck/fsck.c
index 06bf721..6872b00 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -1038,7 +1038,9 @@ check_next:
 			unsigned int isize =
 				le16_to_cpu(node_blk->i.i_extra_isize);
 			if (time_to_inject(FAULT_INODE) ||
-					(isize > 4 * DEF_ADDRS_PER_INODE)) {
+					(isize < F2FS_MIN_EXTRA_ATTR_SIZE) ||
+					(isize > F2FS_TOTAL_EXTRA_ATTR_SIZE) ||
+					(isize % sizeof(__le32))) {
 				ASSERT_MSG("[0x%x] wrong i_extra_isize=0x%x",
 						nid, isize);
 				if (c.fix_on) {
diff --git a/include/f2fs_fs.h b/include/f2fs_fs.h
index 432c80c..4225ffe 100644
--- a/include/f2fs_fs.h
+++ b/include/f2fs_fs.h
@@ -979,6 +979,7 @@ static_assert(sizeof(struct node_footer) == 24, "");
 
 #define F2FS_EXTRA_ISIZE_OFFSET				\
 	offsetof(struct f2fs_inode, i_extra_isize)
+#define F2FS_MIN_EXTRA_ATTR_SIZE	(sizeof(__le32))
 #define F2FS_TOTAL_EXTRA_ATTR_SIZE			\
 	(offsetof(struct f2fs_inode, i_extra_end) - F2FS_EXTRA_ISIZE_OFFSET)
 
-- 
2.49.0



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel