From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792960771; b=wWG9ygaQEH78g+4HN3IfkyGVCHiyl4B2YfHj+UPd4cuDkXSVO6Ywv4k6EaoMW0G+8bfU xaiSKKFjkDjvont+0BMRz35No60ak71grLS17hMwwaGpOGUM+wX+owtrsAEC5TRFXIucF nfbZCoGpYlAx7dDB+rsbATiuggb7v9TjAcRLtkG1+ztNUXpbDM6Om1ZJp0s/DiqYXWkG2 uTOyQE2t5U9RIsXvSWaWuyDNzJIGgrCpWSi5X90xFGxc8UARDL9T/ioAryZDgPPIX34d9 DYfMU6LNB2LB/Vxam+d/WdwXzKuWlnY3G5dZJdeE4qxDCKiVqG2AxKLF5lhTN5FK1iA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792960771; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Transfer-Encoding; bh=Dec6d23kzD9Q7ZmgTNaLfCaR3TzF+qKAdsnxeeBx+Qk=; b=5VjIbbib1YBRzp0kaL7Ila5RnBZQeIeBm93SZSDvE44IGJIaH0ogJeem3ssT5kHJIBUx 0mL3fWf16aKv4GuoMAONRWgRq+Sql31c20IekC6FhduGMcCYekHJN8BLIX+l88nU/8XvP iosSSz7iYYUrtomPSzK2asZ7tV/oSHEF7gf1KTpvFgUpKv4ajBh8xnbZkmqitJcUZUBy0 TXrrj5+jkA+fSln9DkO3BL0FoUGemWyaLrjth2nx4cfQwJT/BKSj3bISd0YiiglwSu710 Yhb8pjAXoLL2Pu4miaAGNtANMnCJBCt4qCealVHeBjvx8tIWgJAscFu9Eispm7lR7ag== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=iSToPKTP; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94C3F606A31A; Sun, 25 Oct 2026 20:39:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=iSToPKTP Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B87C1F01825; Sun, 25 Oct 2026 20:39:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792960771; bh=Dec6d23kzD9Q7ZmgTNaLfCaR3TzF+qKAdsnxeeBx+Qk=; h=From:To:Cc:Subject:Date; b=iSToPKTPDNDUaXbuV1jJFmBiMVnkKX8KG92NdwNokA9KpYlv8kvLJ77rJ6Ff2OC64 B0+5gSWk92sPlFZBNMujMaYXdWDiwpMpvYeR/rhkBovuTDLEuYKBaDRtLqLOhiVG95 FU8E14i1657mzsPlsMkDu60KJ14dzl71px8W1BVWeoZfPmXvN63+yY3tpUJXTT+7r7 0yR6XyCr2XJhhFLjgcsHBaE8erCrbiA0QwC2PC5LKafNF06F7oTwno6syFiR73a9v+ SYTSqta1GeWULcIY00+ImdRvrKdbcnk31RS4wXhWpnB4Tq1WKVG0mBZg59Nl2OjATA UwWDKnaZ/8TrA== From: Eric Biggers To: fsverity@lists.linux.dev Cc: linux-ext4@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-btrfs@vger.kernel.org, Eric Biggers , stable@vger.kernel.org Subject: [PATCH] fsverity: Be more careful with return value of ->get_verity_descriptor() Date: Sun, 25 Oct 2026 13:38:31 -0700 Message-ID: <20261025203831.120095-1-ebiggers@kernel.org> X-Mailer: git-send-email 2.56.0 X-Mailing-List: fsverity@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If fsverity_operations::get_verity_descriptor() returns that the verity descriptor has 0 size, then a zero-size buffer is allocated to hold it, and it's called again with bufsize=0. But bufsize=0 is a special case that says to return the actual size. If in the meantime the filesystem has decided that the size is some actually valid size, it will return that size, and then validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash. Of course, for the filesystem to misbehave in that strange way, it generally would require direct writes to the block device. Regardless, fsverity_get_descriptor() might as well guard against it. Make it do so. Specifically, validate that the first call to ->get_verity_descriptor() returns at least the minimum descriptor size, and validate that the second call returns the same size as the first. Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers --- fs/verity/open.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/fs/verity/open.c b/fs/verity/open.c index 6646290430380..78a65154b8957 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -270,12 +270,6 @@ static bool validate_fsverity_descriptor(struct inode *inode, const struct fsverity_descriptor *desc, size_t desc_size) { - if (desc_size < sizeof(*desc)) { - fsverity_err(inode, "Unrecognized descriptor size: %zu bytes", - desc_size); - return false; - } - if (desc->version != 1) { fsverity_err(inode, "Unrecognized descriptor version: %u", desc->version); @@ -314,31 +308,37 @@ static bool validate_fsverity_descriptor(struct inode *inode, int fsverity_get_descriptor(struct inode *inode, struct fsverity_descriptor **desc_ret) { - int res; + int size, res; struct fsverity_descriptor *desc; - res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0); - if (res < 0) { - fsverity_err(inode, - "Error %d getting verity descriptor size", res); - return res; + size = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0); + if (size < 0) { + fsverity_err(inode, "Error %d getting verity descriptor size", + size); + return size; } - if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) { - fsverity_err(inode, "Verity descriptor is too large (%d bytes)", - res); + if (size < sizeof(*desc) || size > FS_VERITY_MAX_DESCRIPTOR_SIZE) { + fsverity_err(inode, + "Verity descriptor has invalid size (%d bytes)", + size); return -EMSGSIZE; } - desc = kmalloc(res, GFP_KERNEL); + desc = kmalloc(size, GFP_KERNEL); if (!desc) return -ENOMEM; - res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res); + res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, size); if (res < 0) { fsverity_err(inode, "Error %d reading verity descriptor", res); kfree(desc); return res; } - - if (!validate_fsverity_descriptor(inode, desc, res)) { + if (res != size) { + fsverity_err(inode, "Verity descriptor size changed (%d => %d)", + size, res); + kfree(desc); + return -EINVAL; + } + if (!validate_fsverity_descriptor(inode, desc, size)) { kfree(desc); return -EINVAL; } base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7 -- 2.56.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.sourceforge.net (lists.sourceforge.net [216.105.38.7]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 29803606A31A for ; Sun, 25 Oct 2026 20:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=lists.sourceforge.net header.i=@lists.sourceforge.net header.a=rsa-sha256 header.s=beta header.b=l6U4kUvd; dkim=fail reason="signature verification failed" (1024-bit key, unprotected) header.d=sourceforge.net header.i=@sourceforge.net header.a=rsa-sha256 header.s=x header.b=a48D/+KI; dkim=fail reason="signature verification failed" (1024-bit key, unprotected) header.d=sf.net header.i=@sf.net header.a=rsa-sha256 header.s=x header.b=O2dLX7n6; dkim=neutral header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=iSToPKTP DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: Reply-To:From:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:MIME-Version:Message-ID:Date:To:Sender: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Unsubscribe-Post:List-Owner; bh=3e6iK9Rluiix12daFUlIYYbODLg9wCYVAu3Lqc3T8YY=; b=l6U4kUvdVNU1axOhQ8abvicJry yyMDjnYRbTcts3XMcNj0fLY18YPj+MB1R8ctWEnfSvlE5oRuChd66SlvCIL8fuxq47GjNuIINh54N mATSaegxJRxexhINBZauq1SkhNAlyGk2NRwrCkVkV5ONA29u2ivQmjjIGYvpgTbuqoUI=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xL50c-000000008L7-3aMA; Sun, 25 Oct 2026 20:40:02 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xL50D-000000008Js-3boQ for linux-f2fs-devel@lists.sourceforge.net; Sun, 25 Oct 2026 20:39:37 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Dec6d23kzD9Q7ZmgTNaLfCaR3TzF+qKAdsnxeeBx+Qk=; b=a48D/+KImu9kiOJh+u3edAvXgS h9sgd1Wkff9cz81764hB2VrI5wjtiE9VSPMLebalHMS/iXrh1tLa2hCxeNQXe33KyXkYfeUnWv9DS lRHSFpOkoFdUz3TzIG1h5LCXsY7ufUqZdBv3Rmj9Ktre18KMcfeVKCQ4IMA3m2ebCrxg=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Dec6d23kzD9Q7ZmgTNaLfCaR3TzF+qKAdsnxeeBx+Qk=; b=O2dLX7n6JVoXFrXRz632F5IaTd 2mnkdI3uKnf/Q47E2S7hdwkqFoMvraZWH1sj8lF9avAvW+49N9fJqJtrgqqcXKrVYpszdzGPyjLbc jkZFGMWu6IMtH+PP+g8F+UCHmuG602n2e9HtVXshXOjK4YhLQlBs50gKRU204BmGv5/Q=; Received: from tor.source.kernel.org ([172.105.4.254]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xL50D-000000002Cr-0uTJ for linux-f2fs-devel@lists.sourceforge.net; Sun, 25 Oct 2026 20:39:37 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 804BA600CB for ; Sun, 25 Oct 2026 20:39:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B87C1F01825; Sun, 25 Oct 2026 20:39:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792960771; bh=Dec6d23kzD9Q7ZmgTNaLfCaR3TzF+qKAdsnxeeBx+Qk=; h=From:To:Cc:Subject:Date; b=iSToPKTPDNDUaXbuV1jJFmBiMVnkKX8KG92NdwNokA9KpYlv8kvLJ77rJ6Ff2OC64 B0+5gSWk92sPlFZBNMujMaYXdWDiwpMpvYeR/rhkBovuTDLEuYKBaDRtLqLOhiVG95 FU8E14i1657mzsPlsMkDu60KJ14dzl71px8W1BVWeoZfPmXvN63+yY3tpUJXTT+7r7 0yR6XyCr2XJhhFLjgcsHBaE8erCrbiA0QwC2PC5LKafNF06F7oTwno6syFiR73a9v+ SYTSqta1GeWULcIY00+ImdRvrKdbcnk31RS4wXhWpnB4Tq1WKVG0mBZg59Nl2OjATA UwWDKnaZ/8TrA== To: fsverity@lists.linux.dev Date: Sun, 25 Oct 2026 13:38:31 -0700 Message-ID: <20261025203831.120095-1-ebiggers@kernel.org> X-Mailer: git-send-email 2.56.0 X-Archived-By: MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Headers-End: 1xL50D-000000002Cr-0uTJ Subject: [f2fs-dev] [PATCH] fsverity: Be more careful with return value of ->get_verity_descriptor() X-BeenThere: linux-f2fs-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , From: Eric Biggers via Linux-f2fs-devel Reply-To: Eric Biggers Cc: Eric Biggers , linux-ext4@vger.kernel.org, stable@vger.kernel.org, linux-btrfs@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_PASS,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 If fsverity_operations::get_verity_descriptor() returns that the verity descriptor has 0 size, then a zero-size buffer is allocated to hold it, and it's called again with bufsize=0. But bufsize=0 is a special case that says to return the actual size. If in the meantime the filesystem has decided that the size is some actually valid size, it will return that size, and then validate_fsverity_descriptor() will read from ZERO_SIZE_PTR and crash. Of course, for the filesystem to misbehave in that strange way, it generally would require direct writes to the block device. Regardless, fsverity_get_descriptor() might as well guard against it. Make it do so. Specifically, validate that the first call to ->get_verity_descriptor() returns at least the minimum descriptor size, and validate that the second call returns the same size as the first. Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers --- fs/verity/open.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/fs/verity/open.c b/fs/verity/open.c index 6646290430380..78a65154b8957 100644 --- a/fs/verity/open.c +++ b/fs/verity/open.c @@ -270,12 +270,6 @@ static bool validate_fsverity_descriptor(struct inode *inode, const struct fsverity_descriptor *desc, size_t desc_size) { - if (desc_size < sizeof(*desc)) { - fsverity_err(inode, "Unrecognized descriptor size: %zu bytes", - desc_size); - return false; - } - if (desc->version != 1) { fsverity_err(inode, "Unrecognized descriptor version: %u", desc->version); @@ -314,31 +308,37 @@ static bool validate_fsverity_descriptor(struct inode *inode, int fsverity_get_descriptor(struct inode *inode, struct fsverity_descriptor **desc_ret) { - int res; + int size, res; struct fsverity_descriptor *desc; - res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0); - if (res < 0) { - fsverity_err(inode, - "Error %d getting verity descriptor size", res); - return res; + size = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0); + if (size < 0) { + fsverity_err(inode, "Error %d getting verity descriptor size", + size); + return size; } - if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) { - fsverity_err(inode, "Verity descriptor is too large (%d bytes)", - res); + if (size < sizeof(*desc) || size > FS_VERITY_MAX_DESCRIPTOR_SIZE) { + fsverity_err(inode, + "Verity descriptor has invalid size (%d bytes)", + size); return -EMSGSIZE; } - desc = kmalloc(res, GFP_KERNEL); + desc = kmalloc(size, GFP_KERNEL); if (!desc) return -ENOMEM; - res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res); + res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, size); if (res < 0) { fsverity_err(inode, "Error %d reading verity descriptor", res); kfree(desc); return res; } - - if (!validate_fsverity_descriptor(inode, desc, res)) { + if (res != size) { + fsverity_err(inode, "Verity descriptor size changed (%d => %d)", + size, res); + kfree(desc); + return -EINVAL; + } + if (!validate_fsverity_descriptor(inode, desc, size)) { kfree(desc); return -EINVAL; } base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7 -- 2.56.0 _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel