* [PATCH] xfs: harden directory integrity checks some more
@ 2018-01-09 7:13 Darrick J. Wong
2018-01-09 16:09 ` Brian Foster
2018-01-09 18:47 ` [PATCH v2] " Darrick J. Wong
0 siblings, 2 replies; 5+ messages in thread
From: Darrick J. Wong @ 2018-01-09 7:13 UTC (permalink / raw)
To: xfs
From: Darrick J. Wong <darrick.wong@oracle.com>
If a malicious filesystem image contains a block+ format directory
wherein the directory inode's core.mode is set such that
S_ISDIR(core.mode) == 0, and if there are subdirectories of the
corrupted directory, an attempt to traverse up the directory tree will
crash the kernel in __xfs_dir3_data_check. Running the online scrub's
parent checks will tend to do this.
The crash occurs because the directory inode's d_ops get set to
xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
if we have non fatal asserts configured.
Fix the null pointer dereference crash in __xfs_dir3_data_check by
looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
to bail out if it is fed a non-directory "parent".
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
fs/xfs/libxfs/xfs_dir2_data.c | 7 +++++++
fs/xfs/scrub/parent.c | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index 3237812..31d5ec6 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -73,6 +73,13 @@ __xfs_dir3_data_check(
*/
ops = xfs_dir_get_ops(mp, dp);
+ /*
+ * If this isn't a directory, or we got handed the non-dir ops,
+ * something is seriously wrong. Bail out.
+ */
+ if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
+ return __this_address;
+
hdr = bp->b_addr;
p = (char *)ops->data_entry_p(hdr);
diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
index dd704fd..0d38514 100644
--- a/fs/xfs/scrub/parent.c
+++ b/fs/xfs/scrub/parent.c
@@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
goto out;
- if (dp == sc->ip) {
+ if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
goto out_rele;
}
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] xfs: harden directory integrity checks some more
2018-01-09 7:13 [PATCH] xfs: harden directory integrity checks some more Darrick J. Wong
@ 2018-01-09 16:09 ` Brian Foster
2018-01-09 18:25 ` Darrick J. Wong
2018-01-09 18:47 ` [PATCH v2] " Darrick J. Wong
1 sibling, 1 reply; 5+ messages in thread
From: Brian Foster @ 2018-01-09 16:09 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: xfs
On Mon, Jan 08, 2018 at 11:13:36PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> If a malicious filesystem image contains a block+ format directory
> wherein the directory inode's core.mode is set such that
> S_ISDIR(core.mode) == 0, and if there are subdirectories of the
> corrupted directory, an attempt to traverse up the directory tree will
> crash the kernel in __xfs_dir3_data_check. Running the online scrub's
> parent checks will tend to do this.
>
> The crash occurs because the directory inode's d_ops get set to
> xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
> scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
> if we have non fatal asserts configured.
>
> Fix the null pointer dereference crash in __xfs_dir3_data_check by
> looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
> to bail out if it is fed a non-directory "parent".
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
> fs/xfs/libxfs/xfs_dir2_data.c | 7 +++++++
> fs/xfs/scrub/parent.c | 2 +-
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
> index 3237812..31d5ec6 100644
> --- a/fs/xfs/libxfs/xfs_dir2_data.c
> +++ b/fs/xfs/libxfs/xfs_dir2_data.c
> @@ -73,6 +73,13 @@ __xfs_dir3_data_check(
> */
> ops = xfs_dir_get_ops(mp, dp);
>
> + /*
> + * If this isn't a directory, or we got handed the non-dir ops,
> + * something is seriously wrong. Bail out.
> + */
> + if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
> + return __this_address;
> +
I wonder if something like (ops == xfs_nondir_get_ops(mp, NULL)) would
be a bit more explicit for the second part of this check..? Otherwise
seems Ok to me.
Brian
> hdr = bp->b_addr;
> p = (char *)ops->data_entry_p(hdr);
>
> diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
> index dd704fd..0d38514 100644
> --- a/fs/xfs/scrub/parent.c
> +++ b/fs/xfs/scrub/parent.c
> @@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
> error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
> if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
> goto out;
> - if (dp == sc->ip) {
> + if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
> xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
> goto out_rele;
> }
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] xfs: harden directory integrity checks some more
2018-01-09 16:09 ` Brian Foster
@ 2018-01-09 18:25 ` Darrick J. Wong
0 siblings, 0 replies; 5+ messages in thread
From: Darrick J. Wong @ 2018-01-09 18:25 UTC (permalink / raw)
To: Brian Foster; +Cc: xfs
On Tue, Jan 09, 2018 at 11:09:16AM -0500, Brian Foster wrote:
> On Mon, Jan 08, 2018 at 11:13:36PM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> >
> > If a malicious filesystem image contains a block+ format directory
> > wherein the directory inode's core.mode is set such that
> > S_ISDIR(core.mode) == 0, and if there are subdirectories of the
> > corrupted directory, an attempt to traverse up the directory tree will
> > crash the kernel in __xfs_dir3_data_check. Running the online scrub's
> > parent checks will tend to do this.
> >
> > The crash occurs because the directory inode's d_ops get set to
> > xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
> > scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
> > if we have non fatal asserts configured.
> >
> > Fix the null pointer dereference crash in __xfs_dir3_data_check by
> > looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
> > to bail out if it is fed a non-directory "parent".
> >
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> > fs/xfs/libxfs/xfs_dir2_data.c | 7 +++++++
> > fs/xfs/scrub/parent.c | 2 +-
> > 2 files changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
> > index 3237812..31d5ec6 100644
> > --- a/fs/xfs/libxfs/xfs_dir2_data.c
> > +++ b/fs/xfs/libxfs/xfs_dir2_data.c
> > @@ -73,6 +73,13 @@ __xfs_dir3_data_check(
> > */
> > ops = xfs_dir_get_ops(mp, dp);
> >
> > + /*
> > + * If this isn't a directory, or we got handed the non-dir ops,
> > + * something is seriously wrong. Bail out.
> > + */
> > + if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
> > + return __this_address;
> > +
>
> I wonder if something like (ops == xfs_nondir_get_ops(mp, NULL)) would
> be a bit more explicit for the second part of this check..? Otherwise
> seems Ok to me.
Sure, though I prefer (ops != xfs_dir_get_ops(mp, NULL)) for defensive
reasons.
--D
>
> Brian
>
> > hdr = bp->b_addr;
> > p = (char *)ops->data_entry_p(hdr);
> >
> > diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
> > index dd704fd..0d38514 100644
> > --- a/fs/xfs/scrub/parent.c
> > +++ b/fs/xfs/scrub/parent.c
> > @@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
> > error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
> > if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
> > goto out;
> > - if (dp == sc->ip) {
> > + if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
> > xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
> > goto out_rele;
> > }
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] xfs: harden directory integrity checks some more
2018-01-09 7:13 [PATCH] xfs: harden directory integrity checks some more Darrick J. Wong
2018-01-09 16:09 ` Brian Foster
@ 2018-01-09 18:47 ` Darrick J. Wong
2018-01-09 18:56 ` Brian Foster
1 sibling, 1 reply; 5+ messages in thread
From: Darrick J. Wong @ 2018-01-09 18:47 UTC (permalink / raw)
To: xfs; +Cc: Brian Foster
From: Darrick J. Wong <darrick.wong@oracle.com>
If a malicious filesystem image contains a block+ format directory
wherein the directory inode's core.mode is set such that
S_ISDIR(core.mode) == 0, and if there are subdirectories of the
corrupted directory, an attempt to traverse up the directory tree will
crash the kernel in __xfs_dir3_data_check. Running the online scrub's
parent checks will tend to do this.
The crash occurs because the directory inode's d_ops get set to
xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
if we have non fatal asserts configured.
Fix the null pointer dereference crash in __xfs_dir3_data_check by
looking for S_ISDIR or wrong d_ops; and teach the parent scrubber
to bail out if it is fed a non-directory "parent".
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
v2: check for wrong d_ops, not individual function pointers
---
fs/xfs/libxfs/xfs_dir2_data.c | 8 ++++++++
fs/xfs/scrub/parent.c | 2 +-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index 3237812..853d9ab 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -73,6 +73,14 @@ __xfs_dir3_data_check(
*/
ops = xfs_dir_get_ops(mp, dp);
+ /*
+ * If this isn't a directory, or we don't get handed the dir ops,
+ * something is seriously wrong. Bail out.
+ */
+ if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) ||
+ ops != xfs_dir_get_ops(mp, NULL))
+ return __this_address;
+
hdr = bp->b_addr;
p = (char *)ops->data_entry_p(hdr);
diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
index dd704fd..0d38514 100644
--- a/fs/xfs/scrub/parent.c
+++ b/fs/xfs/scrub/parent.c
@@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
goto out;
- if (dp == sc->ip) {
+ if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
goto out_rele;
}
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] xfs: harden directory integrity checks some more
2018-01-09 18:47 ` [PATCH v2] " Darrick J. Wong
@ 2018-01-09 18:56 ` Brian Foster
0 siblings, 0 replies; 5+ messages in thread
From: Brian Foster @ 2018-01-09 18:56 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: xfs
On Tue, Jan 09, 2018 at 10:47:29AM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> If a malicious filesystem image contains a block+ format directory
> wherein the directory inode's core.mode is set such that
> S_ISDIR(core.mode) == 0, and if there are subdirectories of the
> corrupted directory, an attempt to traverse up the directory tree will
> crash the kernel in __xfs_dir3_data_check. Running the online scrub's
> parent checks will tend to do this.
>
> The crash occurs because the directory inode's d_ops get set to
> xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
> scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
> if we have non fatal asserts configured.
>
> Fix the null pointer dereference crash in __xfs_dir3_data_check by
> looking for S_ISDIR or wrong d_ops; and teach the parent scrubber
> to bail out if it is fed a non-directory "parent".
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
> v2: check for wrong d_ops, not individual function pointers
> ---
Reviewed-by: Brian Foster <bfoster@redhat.com>
> fs/xfs/libxfs/xfs_dir2_data.c | 8 ++++++++
> fs/xfs/scrub/parent.c | 2 +-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
> index 3237812..853d9ab 100644
> --- a/fs/xfs/libxfs/xfs_dir2_data.c
> +++ b/fs/xfs/libxfs/xfs_dir2_data.c
> @@ -73,6 +73,14 @@ __xfs_dir3_data_check(
> */
> ops = xfs_dir_get_ops(mp, dp);
>
> + /*
> + * If this isn't a directory, or we don't get handed the dir ops,
> + * something is seriously wrong. Bail out.
> + */
> + if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) ||
> + ops != xfs_dir_get_ops(mp, NULL))
> + return __this_address;
> +
> hdr = bp->b_addr;
> p = (char *)ops->data_entry_p(hdr);
>
> diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
> index dd704fd..0d38514 100644
> --- a/fs/xfs/scrub/parent.c
> +++ b/fs/xfs/scrub/parent.c
> @@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
> error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
> if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
> goto out;
> - if (dp == sc->ip) {
> + if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
> xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
> goto out_rele;
> }
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-01-09 18:56 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-09 7:13 [PATCH] xfs: harden directory integrity checks some more Darrick J. Wong
2018-01-09 16:09 ` Brian Foster
2018-01-09 18:25 ` Darrick J. Wong
2018-01-09 18:47 ` [PATCH v2] " Darrick J. Wong
2018-01-09 18:56 ` Brian Foster
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox