Unlinking a file on a broken UDF image causes kernel BUG

Unlinking a file on a broken UDF image causes kernel BUG

[Anatoly Trosinenko]

[-- Attachment #1: Type: text/plain, Size: 3500 bytes --]

When unlinking a file on a fuzzed UDF image, the kernel BUG is triggered.

How to reproduce (with kvm-xfstests):

1) Checkout udf/for_next (commit 3df77b04f)
2) Copy x86_64-config-4.14 to .config, execute `make olddefconfig`,
then enable UDF support and compile the kernel
3) Copy the attached reproducer to
/tmp/kvm-xfstests-$USER/dump_udf.img (1 Mb uncompressed)
4) Run `kvm-xfstests shell`
5) Inside the shell:

root@kvm-xfstests:~# mount /vtmp
root@kvm-xfstests:~# mount /vtmp/dump_udf.img /mnt
[   20.324420] UDF-fs: error (device loop0): udf_process_sequence:
Primary Volume Descriptor not found!
[   20.325825] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp
2018/06/27 18:03 (1000)
root@kvm-xfstests:~# unlink /mnt/foo
[   28.638288] ------------[ cut here ]------------
[   28.638906] kernel BUG at fs/udf/truncate.c:219!
[   28.639501] invalid opcode: 0000 [#1] SMP PTI
[   28.639946] CPU: 1 PID: 365 Comm: unlink Not tainted
4.19.0-rc2-xfstests-00028-g3df77b04f62 #1
[   28.640803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.10.2-1ubuntu1 04/01/2014
[   28.641772] RIP: 0010:udf_truncate_extents+0x2f3/0x300
[   28.642293] Code: 93 d0 fe ff ff 8d b2 d8 00 00 00 81 c2 b0 00 00
00 83 e1 08 0f 45 d6 29 d0 41 89 c6 e9 17 fe ff ff 0f 0b 0f 0b e8 6d
7d d3 ff <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 53
48 89
[   28.644136] RSP: 0018:ffff9b29408d7d80 EFLAGS: 00010206
[   28.644664] RAX: 0000000000000004 RBX: ffff943c78e8d190 RCX: 0000000000000009
[   28.645376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff943c78e8d190
[   28.646087] RBP: ffff943c7b986000 R08: 00000009676e2d1c R09: 0000000000000001
[   28.646801] R10: 0000000000000001 R11: 0000000000000000 R12: ffff943c78e8d088
[   28.647512] R13: 0000000000000000 R14: 0000000000000002 R15: ffff943c78e8d190
[   28.648223] FS:  0000000000000000(0000) GS:ffff943c7dc00000(0063)
knlGS:00000000f7f4a800
[   28.649028] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   28.649603] CR2: 00000000f7e5ae20 CR3: 000000007822e002 CR4: 00000000003606e0
[   28.650337] Call Trace:
[   28.650589]  ? udf_setsize+0x281/0x3e0
[   28.650981]  udf_setsize+0x289/0x3e0
[   28.651349]  ? evict+0xba/0x1a0
[   28.651673]  udf_evict_inode+0x86/0xe0
[   28.652057]  evict+0xd0/0x1a0
[   28.652365]  do_unlinkat+0x1ad/0x310
[   28.652732]  do_fast_syscall_32+0x9d/0x2f0
[   28.653151]  entry_SYSENTER_compat+0x84/0x96
[   28.653603] ---[ end trace 7a5c71f2169e9e21 ]---
[   28.654073] RIP: 0010:udf_truncate_extents+0x2f3/0x300
[   28.654595] Code: 93 d0 fe ff ff 8d b2 d8 00 00 00 81 c2 b0 00 00
00 83 e1 08 0f 45 d6 29 d0 41 89 c6 e9 17 fe ff ff 0f 0b 0f 0b e8 6d
7d d3 ff <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 53
48 89
[   28.656501] RSP: 0018:ffff9b29408d7d80 EFLAGS: 00010206
[   28.657038] RAX: 0000000000000004 RBX: ffff943c78e8d190 RCX: 0000000000000009
[   28.657734] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff943c78e8d190
[   28.658456] RBP: ffff943c7b986000 R08: 00000009676e2d1c R09: 0000000000000001
[   28.659172] R10: 0000000000000001 R11: 0000000000000000 R12: ffff943c78e8d088
[   28.659895] R13: 0000000000000000 R14: 0000000000000002 R15: ffff943c78e8d190
[   28.660614] FS:  0000000000000000(0000) GS:ffff943c7dc00000(0063)
knlGS:00000000f7f4a800
[   28.661425] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   28.662006] CR2: 00000000f7e5ae20 CR3: 000000007822e002 CR4: 00000000003606e0
Segmentation fault
root@kvm-xfstests:~#

Best regards
Anatoly

[-- Attachment #2: dump_udf.img.bz2 --]
[-- Type: application/octet-stream, Size: 1220 bytes --]

Re: Unlinking a file on a broken UDF image causes kernel BUG

[Jan Kara]

[-- Attachment #1: Type: text/plain, Size: 772 bytes --]

Hi,

On Sun 14-10-18 18:27:25, Anatoly Trosinenko wrote:
> When unlinking a file on a fuzzed UDF image, the kernel BUG is triggered.
> 
> How to reproduce (with kvm-xfstests):
> 
> 1) Checkout udf/for_next (commit 3df77b04f)
> 2) Copy x86_64-config-4.14 to .config, execute `make olddefconfig`,
> then enable UDF support and compile the kernel
> 3) Copy the attached reproducer to
> /tmp/kvm-xfstests-$USER/dump_udf.img (1 Mb uncompressed)
> 4) Run `kvm-xfstests shell`
> 5) Inside the shell:

Thanks for report and sorry it took so long for me to get to this. Attached
patch fixes the issue for me.

Unless someone objects, I'm going to merge the patch to my tree and push it
to Linus in the coming merge window.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[-- Attachment #2: 0001-udf-Fix-BUG-on-corrupted-inode.patch --]
[-- Type: text/x-patch, Size: 1123 bytes --]

From d524d42ca22801418c3f2c1cb1bf6e79c1ee217c Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 12 Dec 2018 14:29:20 +0100
Subject: [PATCH] udf: Fix BUG on corrupted inode

When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/udf/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 5df554a9f9c9..ae796e10f68b 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1357,6 +1357,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 
 	iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
 							ICBTAG_FLAG_AD_MASK;
+	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+		ret = -EIO;
+		goto out;
+	}
 	iinfo->i_unique = 0;
 	iinfo->i_lenEAttr = 0;
 	iinfo->i_lenExtents = 0;
-- 
2.16.4