From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A99AFBA3E for ; Tue, 7 Mar 2023 17:48:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E85CCC4339B; Tue, 7 Mar 2023 17:48:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678211302; bh=ie7CWAhDTLcFB4xHbslr9QPrVo7eYndH64xQFGYOP1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KutBYAf5VjRaTh405jChpjrAgJAWs5pNl95JmYr7EHr/8TUrtOjT1jshKlaBKRF3F hfa8Tr6W1YajwL8JB5rppOjkK7rten2lkrslcbYpoSsi9DZ3fEAEw71/YItE4cJpxo Vh9iLgC4w4Jj8a2bW+V66OctgRZ3OF3VEj0l501E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com, Jan Kara Subject: [PATCH 6.2 0818/1001] udf: Detect system inodes linked into directory hierarchy Date: Tue, 7 Mar 2023 17:59:50 +0100 Message-Id: <20230307170057.252801361@linuxfoundation.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230307170022.094103862@linuxfoundation.org> References: <20230307170022.094103862@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Jan Kara commit 85a37983ec69cc9fcd188bc37c4de15ee326355a upstream. When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa. CC: stable@vger.kernel.org Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/udf/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1885,8 +1885,13 @@ struct inode *__udf_iget(struct super_bl if (!inode) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + if (!(inode->i_state & I_NEW)) { + if (UDF_I(inode)->i_hidden != hidden_inode) { + iput(inode); + return ERR_PTR(-EFSCORRUPTED); + } return inode; + } memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr)); err = udf_read_inode(inode, hidden_inode);