From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793895822; b=Dg1EN0kstn3xvRHGBlQhP6N9qKmR0MgB1pa+s2uGZBi3xIpaxSbUlrolfCSyePwqPBj/ nsZfySItKHIb71YOlqm9+XashDvKNyIbZeaiwvx8y+rTnaFl1cq50F14klLcX8NgTXKXI KHxdLjGseZzMXs4DNpGz2VmfC14BC+o0vH4HoYoS4SJFS1lc5MYw83OaxTnfbk177+zvE 0acizynKh90xdHVUH/HIaZtGIuqyIaXu8GlqsOa+4CKeqPjJObCIWyaF0VWt8f+lT5spQ T2cjdyBZvwTS7APpkchIKY5i2eEVVWaoc+wbQwxSlZhYq/2n/ymcUHbn0JqtFfnf+2w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793895822; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=LFtLCgqDl9jxjeT/z4lnHOfCaRwlLP/Rwzs+TtnEPYM=; b=291DmbBrwMz6AVNkEfNL9WHDlSq7BD3wY72vipxvC4LhGIWmFU828dMFsJso9EQXo1P6 Xz88eui0MVuZxcJlCYK3OfNLZiltlCuzMtg0kSt4JgRPgxKtB4s6KHoMI+9gaeIucDS1U Po/HwxzpMBBkkRDLCZvQZV1I0Lk40Kwj/ok5pJL/xZfsuisMifLFuCaiD8RaI/Go1Xq/l lzR2UDPHb2s05UVAllIAvGGfwlfC0TTBYSplJMNkYEBlhDHqudBNIbnj9tBLGChP5Ru+t S3X80IPMDAYrapINLfrhONyG/mmCmEq9nnLFrc33O/aFu3vhi5L2tDAfRBKLh/UiBww== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b="A4+2/W4g"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF987606A328 for ; Thu, 5 Nov 2026 16:23:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=A4+2/W4g Received: by smtp.kernel.org (Postfix) with ESMTPSA id C48B61F00A02; Thu, 5 Nov 2026 16:23:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793895821; bh=LFtLCgqDl9jxjeT/z4lnHOfCaRwlLP/Rwzs+TtnEPYM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=A4+2/W4g3KL/vPJKIbLptQl8Za9CFpY2tP1JcGxGLWvT6YXcdNCuFyAgv+AT974wl 4Dle2V6nEk8x4wp0ECiI1+qKCFBs0IFZcQ3eq+llxyhmuzQU3W/KrRrV9K9pEP0SKq 5pKGKrSLNIkKTcFmRrxoSWRUcyr60MdmSZJgPhNmE+VzXtnizgrx6nQirug+/dVZc4 50IwnLVhIJTdLG11+0OEwxLH+P6peXr7ZCis9wsjobihRDJcC5lYmc4ZW+806C/rs6 VpulBPw874kzq+D5Rqoei+EPdfUbC2+BWw7Zpd9ob5SXt7p/WPwUHBJqXtql21pNPu zruvoP8vi2wlQ== From: Sasha Levin To: stable@vger.kernel.org Cc: "Darrick J. Wong" , Christoph Hellwig , Carlos Maiolino , Sasha Levin Subject: [PATCH 6.18.y 2/2] xfs: improve dirent bounds checking in scrub and repair Date: Thu, 5 Nov 2026 11:23:38 -0500 Message-ID: <20261105162325.2112487-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105162325.2112487-1-sashal@kernel.org> References: <2026110438-luckless-handiwork-a5c4@gregkh> <20261105162325.2112487-1-sashal@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: "Darrick J. Wong" [ Upstream commit 5d470234d04dae6fe2ca2cf4b9ef277b78c7e05a ] LOLLM complains that we don't do enough bounds checking of the directory entries in directory blocks when we're looking for errors or trying to salvage entries. Let's improve that with more detailed checks. Cc: stable@vger.kernel.org # v4.16 Fixes: ce92d29ddf9908 ("xfs: directory scrubber must walk through data block to offset") Signed-off-by: Darrick J. Wong Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Sasha Levin --- fs/xfs/scrub/dir.c | 68 +++++++++++++++++++++++++++++++++------ fs/xfs/scrub/dir_repair.c | 37 ++++++++++++++++++--- 2 files changed, 91 insertions(+), 14 deletions(-) diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c index 2f73baee0f0b4..495fdf3b519ae 100644 --- a/fs/xfs/scrub/dir.c +++ b/fs/xfs/scrub/dir.c @@ -323,11 +323,24 @@ xchk_dir_check_unused( struct xchk_da_btree *ds, struct xfs_buf *bp, unsigned int iter_off, - unsigned int end) + unsigned int end, + xfs_dablk_t rec_bno) { struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off; + unsigned int advance; + + if (iter_off + sizeof(*dup) > end) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + return -1; + } + + advance = xfs_dir2_data_unusedsize(be16_to_cpu(dup->length)); + if (!advance || iter_off + advance > end) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + return -1; + } - return be16_to_cpu(dup->length); + return advance; } /* @@ -341,15 +354,31 @@ xchk_dir_check_entry( struct xfs_buf *bp, unsigned int iter_off, unsigned int end, - struct xfs_dir2_data_entry *dent) + struct xfs_dir2_data_entry *dent, + xfs_dablk_t rec_bno) { struct xfs_dir2_data_entry *dep = bp->b_addr + iter_off; struct xfs_mount *mp = ds->state->mp; + unsigned int advance; + + /* must have namelen */ + advance = offsetof(typeof(*dep), name); + if (iter_off + advance >= end) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + return -1; + } + + /* Don't walk off the end of the block. */ + advance = xfs_dir2_data_entsize(mp, dep->namelen); + if (!advance || iter_off + advance > end) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + return -1; + } if (dep == dent) return 0; - return xfs_dir2_data_entsize(mp, dep->namelen); + return advance; } /* Scrub a directory btree record. */ @@ -377,6 +406,7 @@ xchk_dir_rec( xfs_dahash_t hash; struct xfs_dir3_icleaf_hdr hdr; unsigned int tag; + bool foundit = false; int error; ASSERT(blk->magic == XFS_DIR2_LEAF1_MAGIC || @@ -421,33 +451,44 @@ xchk_dir_rec( dent = bp->b_addr + off; /* Make sure we got a real directory entry. */ - iter_off = geo->data_entry_offset; end = xfs_dir3_data_end_offset(geo, bp->b_addr); if (!end) { xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); goto out_relse; } - for (;;) { + iter_off = geo->data_entry_offset; + while (iter_off < end) { struct xfs_dir2_data_unused *dup = bp->b_addr + iter_off; int advance; - if (iter_off >= end) { + /* must have freetag */ + advance = offsetof(typeof(*dup), length); + if (iter_off + advance >= end) { xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); goto out_relse; } if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) - advance = xchk_dir_check_unused(ds, bp, iter_off, end); + advance = xchk_dir_check_unused(ds, bp, iter_off, end, + rec_bno); else advance = xchk_dir_check_entry(ds, bp, iter_off, end, - dent); + dent, rec_bno); if (advance < 0) goto out_relse; - if (!advance) + if (!advance) { + foundit = true; break; + } iter_off += advance; } + /* Hash tree must point to the exact dirent */ + if (!foundit) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + goto out_relse; + } + /* Retrieve the entry, sanity check it, and compare hashes. */ ino = be64_to_cpu(dent->inumber); hash = be32_to_cpu(ent->hashval); @@ -459,6 +500,13 @@ xchk_dir_rec( goto out_relse; } + /* Name must not overflow end of block */ + if ((char *)dent->name + dent->namelen > + (char *)bp->b_addr + BBTOB(bp->b_length)) { + xchk_fblock_set_corrupt(ds->sc, XFS_DATA_FORK, rec_bno); + goto out_relse; + } + /* Does the directory hash match? */ dname.name = dent->name; dname.len = dent->namelen; diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c index f8e88b638c43d..c7fd39fd83a48 100644 --- a/fs/xfs/scrub/dir_repair.c +++ b/fs/xfs/scrub/dir_repair.c @@ -473,8 +473,16 @@ xrep_dir_recover_unused( unsigned int end) { struct xfs_dir2_data_unused *dup = bp->b_addr + offset; + unsigned int advance; + + if (offset + sizeof(*dup) > end) + return 0; + + advance = xfs_dir2_data_unusedsize(be16_to_cpu(dup->length)); + if (!advance || offset + advance > end) + return 0; - return be16_to_cpu(dup->length); + return advance; } /* @@ -492,11 +500,14 @@ xrep_dir_recover_entry( unsigned int advance; int error; + /* must have namelen */ + advance = offsetof(typeof(*dep), name); + if (offset + advance >= end) + return 0; + /* Don't walk off the end of the block. */ advance = xfs_dir2_data_entsize(rd->sc->mp, dep->namelen); - if (!advance) - return 0; - if (offset + advance > end) + if (!advance || offset + advance > end) return 0; /* Ok, let's save this entry. */ @@ -534,6 +545,11 @@ xrep_dir_recover_data( if (xchk_should_terminate(rd->sc, &error)) return error; + /* must have freetag */ + advance = offsetof(typeof(*dup), length); + if (offset + advance >= end) + break; + if (dup->freetag == cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) advance = xrep_dir_recover_unused(bp, offset, end); else @@ -565,6 +581,19 @@ xrep_dir_recover_sf( hdr = ifp->if_data; end = (unsigned char *)ifp->if_data + ifp->if_bytes; + /* sf header must be big enough for count/i8count */ + if (!hdr || ifp->if_bytes < 2) + return 0; + + /* and large enough for the parent inumber */ + if (hdr->i8count) { + if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[8])) + return 0; + } else { + if (ifp->if_bytes < offsetof(struct xfs_dir2_sf_hdr, parent[4])) + return 0; + } + ino = xfs_dir2_sf_get_parent_ino(hdr); trace_xrep_dir_salvaged_parent(rd->sc->ip, ino); -- 2.53.0