From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.105.38.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7C56AC433F5 for ; Sat, 11 Dec 2021 15:41:26 +0000 (UTC) Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1mw4V2-00081s-AU; Sat, 11 Dec 2021 15:41:24 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1mw4V1-00081m-6M for linux-f2fs-devel@lists.sourceforge.net; Sat, 11 Dec 2021 15:41:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=eu0GQzr3v96Y68y8DZc6N3wNkaaKjefAMkBhGS3vL2o=; b=SWgq5PdPWb4o8nVtoEqninHhbn i7jVNI9hG7yUC+PltUtBRFtArINwBd5kd0JghN6zZHAnIuxt/1q03NSw3pDt2iHJ0f4FfJ18/ny3G iJSMutjC8fr66lEvH4wWkzBuGiQsOKqxrlnPVwU1PK5AotucwddaskF66OgBOCtIFD5M=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=eu0GQzr3v96Y68y8DZc6N3wNkaaKjefAMkBhGS3vL2o=; b=A TP471uunp1BpIyketq7dOYJNYWS5c8xa/GVSuT0nIBSctxdH79kVVBFoWTR/pXyxtSKFgaAx5vgoz qz4sZc9CdjdtEiPBJvEndSV/YaZZg278h5MFJSL+8NmstjpdM3Sfs2TBrBwsU3PPCaMko9B2jKIDr SSqaHv5eQEGRHd6Q=; Received: from sin.source.kernel.org ([145.40.73.55]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.3) id 1mw4V0-0002S9-CX for linux-f2fs-devel@lists.sourceforge.net; Sat, 11 Dec 2021 15:41:23 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id F0042CE000E; Sat, 11 Dec 2021 15:41:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97CE0C004DD; Sat, 11 Dec 2021 15:41:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1639237269; bh=/yzdGEDxV8GD43o8d2iS7Fpu19V4hNZBpBWubgsd76I=; h=From:To:Cc:Subject:Date:From; b=kXDkugGdSQy97nMVvk9XMQvGnZ92/Z00n8oJAp5IrpPX9xpIp9YxlYkvoRa1CBdW0 LKeRZQbECeyUagoUAmw/QYcAjYbdyAurISTA1jzXouVvnq4tIDDjuZzmxtIDGbOBBf ZaNWx7eXtrylPUFIfsk75oAYCVt12gbxF1Tr1E29U58LIckXQYdcub8yMZma4pUny8 L6yBtR/Rkl6ZNTLyKZXQJ85WgLazhE+ZvADr2mQZcxwE3TnSLIrWEO0lGD4p1T2ZTR cWmndM8kjPBpZ9ScrbPp4mfSrrIzfVVjVEHOhh8evIPmAtg3I3jjlzL+aip64Cr9ID 9zEUW+wZvI2Tw== From: Chao Yu To: jaegeuk@kernel.org Date: Sat, 11 Dec 2021 23:40:59 +0800 Message-Id: <20211211154059.7173-1-chao@kernel.org> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-Headers-End: 1mw4V0-0002S9-CX Subject: [f2fs-dev] [PATCH] f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() X-BeenThere: linux-f2fs-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Wenqing Liu , linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: linux-f2fs-devel-bounces@lists.sourceforge.net As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215235 - Overview page fault in f2fs_setxattr() when mount and operate on corrupted image - Reproduce tested on kernel 5.16-rc3, 5.15.X under root 1. unzip tmp7.zip 2. ./single.sh f2fs 7 Sometimes need to run the script several times - Kernel dump loop0: detected capacity change from 0 to 131072 F2FS-fs (loop0): Found nat_bits in checkpoint F2FS-fs (loop0): Mounted with checkpoint version = 7548c2ee BUG: unable to handle page fault for address: ffffe47bc7123f48 RIP: 0010:kfree+0x66/0x320 Call Trace: __f2fs_setxattr+0x2aa/0xc00 [f2fs] f2fs_setxattr+0xfa/0x480 [f2fs] __f2fs_set_acl+0x19b/0x330 [f2fs] __vfs_removexattr+0x52/0x70 __vfs_removexattr_locked+0xb1/0x140 vfs_removexattr+0x56/0x100 removexattr+0x57/0x80 path_removexattr+0xa3/0xc0 __x64_sys_removexattr+0x17/0x20 do_syscall_64+0x37/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is in __f2fs_setxattr(), we missed to do sanity check on last xattr entry, result in out-of-bound memory access during updating inconsistent xattr data of target inode. After the fix, it can detect such xattr inconsistency as below: F2FS-fs (loop11): inode (7) has invalid last xattr entry, entry_size: 60676 F2FS-fs (loop11): inode (8) has corrupted xattr F2FS-fs (loop11): inode (8) has corrupted xattr F2FS-fs (loop11): inode (8) has invalid last xattr entry, entry_size: 47736 Cc: stable@vger.kernel.org Reported-by: Wenqing Liu Signed-off-by: Chao Yu --- fs/f2fs/xattr.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index e348f33bcb2b..c544100643c8 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -684,8 +684,17 @@ static int __f2fs_setxattr(struct inode *inode, int index, } last = here; - while (!IS_XATTR_LAST_ENTRY(last)) + while (!IS_XATTR_LAST_ENTRY(last)) { + if ((void *)(last) + sizeof(__u32) > last_base_addr || + (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) { + f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %lu", + inode->i_ino, ENTRY_SIZE(last)); + set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK); + error = -EFSCORRUPTED; + goto exit; + } last = XATTR_NEXT_ENTRY(last); + } newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size); -- 2.32.0 _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel