From patchwork Thu Jun 14 16:15:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tigran Aivazian X-Patchwork-Id: 10464833 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 27F1F6020F for ; Thu, 14 Jun 2018 16:15:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1882E28A4D for ; Thu, 14 Jun 2018 16:15:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0BF2228B66; Thu, 14 Jun 2018 16:15:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 86DEC28A4D for ; Thu, 14 Jun 2018 16:15:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964834AbeFNQPk (ORCPT ); Thu, 14 Jun 2018 12:15:40 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:36944 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964964AbeFNQPi (ORCPT ); Thu, 14 Jun 2018 12:15:38 -0400 Received: by mail-wm0-f66.google.com with SMTP id r125-v6so13063309wmg.2 for ; Thu, 14 Jun 2018 09:15:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9FPirgyxapt4tqG/JN6S6P0Dnt47q5alLFNmIzJgoHc=; b=jZBv4dKjI3RiesPIkYiFJyoU/yHiwnff4NHNx34CRjJPYRU4yItdGKBHa4/Y6KU3Tc P6r8Z9eY7YrF64i7Gow3hE8A1shl4wq5Wi/PX3cdEDFUB3pelWMsyiRnTk1Pun6bGg96 95pD7B7yWhB2ZlKuFyZjaqeX2pFarxcK3aNAbYuQ9ogwhyyE8gk61HeRqrFfNB0GNPkC vu4/5VXzPvZCbpyOgIjnvuLbxKd0JfTLBehd+dvWigIt/TByFDYKusg953twnP1HizOG zoLn9hzGZbAZXMK+wVQsDPHeu1Squbie/fsKufzgO9takZnGqtsh6FsGA48Jd/sJGARm RHvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9FPirgyxapt4tqG/JN6S6P0Dnt47q5alLFNmIzJgoHc=; b=dquxT3huiDF7WlhUyiCNZ0/ndbqeKmSYr+RoupCkVeDOif3EnY/NcBOZ9hoJ4le461 /9ECFQe+Q0kalTZ+lzoVLHo90mCRWqRS1lKj53mRDxOjglRgxg+6ellzo/pXuUOHxeUn HoGbfASSB2q/kEimbXJuLoVqgyhbK70TGm8mUs/TaaZhXr9GfP1PH7xQ9lF3YeWLK/Ck 9L01a+Du69+GyHbSkwWCpJlbgY+6mN4O5k5zTWgdJXPyD8ioPTU0ON9vwJpGQIEZI6X6 XFlaVfFL2mfiEALgGuNkHopDX6YAEYKNFXsLrvW5Xwhc9tJRpRgJ/m+8K2jCXroona1F GKxg== X-Gm-Message-State: APt69E1K8F2A50ft4bTGFT+pGldFtV8MZDNDgSAlGNkLV64jZ/w2hOE6 PBYU8GW6P6qx8lKU1IZoXbPMu3g4nU8aXnQ1N4OjKA== X-Google-Smtp-Source: ADUXVKKa++3rptDwfcgVrWx2pstXpfBD2RpDgfyp4+4f394hIvyPwAYXqmDY3Dz2MayBt+pIgN7ULsjKOZa8oWTRF8o= X-Received: by 2002:a1c:ad09:: with SMTP id w9-v6mr2605710wme.95.1528992937092; Thu, 14 Jun 2018 09:15:37 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a1c:d801:0:0:0:0:0 with HTTP; Thu, 14 Jun 2018 09:15:36 -0700 (PDT) In-Reply-To: References: <1525862104-3407-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp> <20180509160658.c37bef542a8ee5245a13917b@linux-foundation.org> <201805092346.w49NkINl045657@www262.sakura.ne.jp> <20180509165321.3b2b1313fde0f007c1a5a015@linux-foundation.org> <9ef86114-02d6-b243-203d-fbbdab95a6fa@I-love.SAKURA.ne.jp> From: Tigran Aivazian Date: Thu, 14 Jun 2018 17:15:36 +0100 Message-ID: Subject: Re: [PATCH] bfs: add sanity check at bfs_fill_super(). To: Tetsuo Handa Cc: Dmitry Vyukov , Andrew Morton , linux-fsdevel , syzbot , syzkaller-bugs Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 14 June 2018 at 16:13, Tigran Aivazian wrote: > On 14 June 2018 at 14:28, Tetsuo Handa > wrote: >> What is possible largest value for imap_len ? >> >> info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE) / sizeof(struct bfs_inode) + BFS_ROOT_INO - 1; >> imap_len = (info->si_lasti / 8) + 1; >> info->si_imap = kzalloc(imap_len, GFP_KERNEL); >> >> Since sizeof(struct bfs_inode) is 64 and bfs_sb->s_start is unsigned 32bits integer >> (where constraints is BFS_BSIZE <= bfs_sb->s_start <= bfs_sb->s_end), theoretically >> it is possible to assign bfs_sb->s_start > 2GB (apart from whether such value makes >> sense). Then, isn't it possible that imap_len > 4M and still hit KMALLOC_MAX_SIZE limit? > > You are correct, but the proper fix should be to restrict imap_len to > whatever the maximum value allowed by BFS filesystem layout and reject > anything beyond it. I will try to remember what it was from the notes > I made when I wrote BFS back in 1999. Please wait (possibly a few > days) and I will let you know what those values are. Actually, a more accurate sanity check for the value of s_start should be (patch against 4.16.3): However, that doesn't address the issue of the _upper_ limit of s_start, i.e. it can still get (on an invalid image pretending to be BFS) arbitrarily large and cause the allocation to fail as you described. I will dig a bit more (in my memories :) and try to come up with the check which doesn't reject a valid BFS image and at the same time restricts s_start (or imap_len which ultimately depends on it) sufficiently to prevent wild kernel memory allocation requests. Btw, I included in the WikiPedia article "Boot File System" a reference to the original "BFS kernel support" webpage from those ancient days: http://ftp.linux.org.uk/pub/linux/iBCS/bfs/ --- fs/bfs/inode.c.0 2018-06-14 16:50:52.136792126 +0100 +++ fs/bfs/inode.c 2018-06-14 16:51:49.344792119 +0100 @@ -350,7 +350,8 @@ s->s_magic = BFS_MAGIC; - if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) { + if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) || + le32_to_cpu(bfs_sb->s_start) < sizeof(struct bfs_super_block) + sizeof(struct bfs_dirent)) { printf("Superblock is corrupted\n"); goto out1; }