[PATCH] btrfs: validate legacy free space cache entry types

[PATCH] btrfs: validate legacy free space cache entry types

[Zhang Cen]

Legacy free-space cache v1 stores each entry type as a raw u8, but
__load_free_space_cache() only special-cases EXTENT and treats every other
value as a bitmap entry. In normal builds the remaining bitmap count is
guarded only by ASSERT(), so a malformed cache can consume bitmap pages past
the header budget.

Reject unknown entry types and fail the cache load when a bitmap entry exceeds
the header's num_bitmaps count. The existing error path already discards a
bogus cache and rebuilds it, so valid caches keep their current behavior while
malformed ones are stopped before bitmap loading.

Sanitizer validation reported:
KASAN slab-out-of-bounds in io_ctl_check_crc()
Read of size 8
Call trace:
  dump_stack_lvl() (?:?)
  print_address_description() (mm/kasan/report.c:373)
  io_ctl_check_crc() (fs/btrfs/free-space-cache.c:552)
  print_report() (?:?)
  __virt_addr_valid() (?:?)
  srso_alias_return_thunk() (arch/x86/include/asm/nospec-branch.h:375)
  kasan_addr_to_slab() (mm/kasan/common.c:45)
  kasan_report() (?:?)
  find_held_lock() (kernel/locking/lockdep.c:5340)
  __lock_release() (kernel/locking/lockdep.c:5511)
  _raw_spin_unlock() (kernel/locking/spinlock.c:188)
  btrfs_alloc_root() (fs/btrfs/disk-io.c:606)
  btrfs_test_fscache_unknown_entry_type() (fs/btrfs/free-space-cache.c:?)
  btrfs_run_sanity_tests() (fs/btrfs/free-space-cache.c:?)
  init_btrfs_fs() (fs/btrfs/super.c:2690)
  do_one_initcall() (init/main.c:1382)
  __kasan_kmalloc() (?:?)
  rcu_is_watching() (?:?)
  do_initcalls() (init/main.c:1457)
  kernel_init_freeable() (init/main.c:1674)
  kernel_init() (init/main.c:1584)
  ret_from_fork() (?:?)
  __switch_to() (?:?)
  ret_from_fork_asm() (?:?)
  kasan_save_stack() (mm/kasan/common.c:52)
  kasan_save_track() (mm/kasan/common.c:74)
  __kmalloc_noprof() (?:?)
  io_ctl_init() (fs/btrfs/free-space-cache.c:378)

Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>

---
 fs/btrfs/free-space-cache.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index ab22e4f9ffdd..71797c647f8a 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -839,8 +839,14 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 				kmem_cache_free(btrfs_free_space_cachep, e);
 				goto free_cache;
 			}
-		} else {
-			ASSERT(num_bitmaps);
+		} else if (type == BTRFS_FREE_SPACE_BITMAP) {
+			if (!num_bitmaps) {
+				ret = -EUCLEAN;
+				btrfs_err(fs_info,
+					  "free space cache has more bitmap entries than bitmaps");
+				kmem_cache_free(btrfs_free_space_cachep, e);
+				goto free_cache;
+			}
 			num_bitmaps--;
 			e->bitmap = kmem_cache_zalloc(
 					btrfs_free_space_bitmap_cachep, GFP_NOFS);
@@ -864,6 +870,12 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 			recalculate_thresholds(ctl);
 			spin_unlock(&ctl->tree_lock);
 			list_add_tail(&e->list, &bitmaps);
+		} else {
+			ret = -EUCLEAN;
+			btrfs_err(fs_info,
+				  "unknown free space cache entry type %u", type);
+			kmem_cache_free(btrfs_free_space_cachep, e);
+			goto free_cache;
 		}
 
 		num_entries--;
-- 
2.43.0