[PATCH] btrfs: validate free space cache page 0 header size on read

[PATCH] btrfs: validate free space cache page 0 header size on read

[Zhang Cen]

io_ctl_init() derives num_pages from i_size_read(inode), and
__load_free_space_cache() at fs/btrfs/free-space-cache.c:793 calls it
before verifying the first cache page. The write path already rejected
layouts where num_pages * sizeof(u32) + sizeof(u64) does not fit in page
0, but the read path bypassed that check because io_ctl_init() only
enforced it for writers.

That lets a malformed v1 free space cache inode reach
io_ctl_check_generation() and io_ctl_check_crc() with a page 0 header
that does not fit. io_ctl_check_generation() advances to the generation
field at fs/btrfs/free-space-cache.c:519, and io_ctl_check_crc() hashes
from io_ctl->orig + offset at fs/btrfs/free-space-cache.c:565, so
oversized num_pages values can access beyond page 0 before the cache is
rejected.

Validate the page 0 header size for every io_ctl_init() caller and use a
u64 page count while checking the bound. Malformed free space cache
inodes now fail fast and fall back to rebuilding the cache instead of
parsing past the first page.

Sanitizer validation reported:
KASAN slab-out-of-bounds in io_ctl_check_generation()
Read of size 8
Call trace:
  dump_stack_lvl() (?:?)
  print_address_description() (mm/kasan/report.c:373)
  io_ctl_check_generation() (fs/btrfs/free-space-cache.c:512)
  print_report() (?:?)
  __virt_addr_valid() (?:?)
  srso_alias_return_thunk() (arch/x86/include/asm/nospec-branch.h:375)
  kasan_addr_to_slab() (mm/kasan/common.c:45)
  kasan_report() (?:?)
  btrfs_test_fscache_page0_header_overflow() (fs/btrfs/free-space-cache.c:?)
  btrfs_free_dummy_fs_info() (fs/btrfs/tests/btrfs-tests.c:155)
  kfree() (?:?)
  btrfs_run_sanity_tests() (fs/btrfs/free-space-cache.c:?)
  init_btrfs_fs() (fs/btrfs/super.c:2690)
  do_one_initcall() (init/main.c:1382)
  __kasan_kmalloc() (?:?)
  rcu_is_watching() (?:?)
  do_initcalls() (init/main.c:1457)
  kernel_init_freeable() (init/main.c:1674)
  kernel_init() (init/main.c:1584)
  ret_from_fork() (?:?)
  __switch_to() (?:?)
  ret_from_fork_asm() (?:?)
  kasan_save_stack() (mm/kasan/common.c:52)
  kasan_save_track() (mm/kasan/common.c:74)

Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>

---
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index ab22e4f9ffdd..c8d240b555fe 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -375,15 +375,14 @@ static void readahead_cache(struct inode *inode)
 	page_cache_sync_readahead(inode->i_mapping, &ra, NULL, 0, last_index);
 }
 
-static int io_ctl_init(struct btrfs_io_ctl *io_ctl, struct inode *inode,
-		       int write)
+static int io_ctl_init(struct btrfs_io_ctl *io_ctl, struct inode *inode)
 {
-	int num_pages;
+	u64 num_pages;
 
 	num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
 
 	/* Make sure we can fit our crcs and generation into the first page */
-	if (write && (num_pages * sizeof(u32) + sizeof(u64)) > PAGE_SIZE)
+	if (num_pages * sizeof(u32) + sizeof(u64) > PAGE_SIZE)
 		return -ENOSPC;
 
 	memset(io_ctl, 0, sizeof(struct btrfs_io_ctl));
@@ -791,7 +790,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 	if (!num_entries)
 		return 0;
 
-	ret = io_ctl_init(&io_ctl, inode, 0);
+	ret = io_ctl_init(&io_ctl, inode);
 	if (ret)
 		return ret;
 
@@ -1384,7 +1383,7 @@ static int __btrfs_write_out_cache(struct inode *inode,
 		return -EIO;
 
 	WARN_ON(io_ctl->pages);
-	ret = io_ctl_init(io_ctl, inode, 1);
+	ret = io_ctl_init(io_ctl, inode);
 	if (ret)
 		return ret;