diff mbox

xfs: harden directory integrity checks some more

Message ID 20180109071336.GD5602@magnolia (mailing list archive)
State Superseded
Headers show

Commit Message

Darrick J. Wong Jan. 9, 2018, 7:13 a.m. UTC 
From: Darrick J. Wong <darrick.wong@oracle.com>

If a malicious filesystem image contains a block+ format directory
wherein the directory inode's core.mode is set such that
S_ISDIR(core.mode) == 0, and if there are subdirectories of the
corrupted directory, an attempt to traverse up the directory tree will
crash the kernel in __xfs_dir3_data_check.  Running the online scrub's
parent checks will tend to do this.

The crash occurs because the directory inode's d_ops get set to
xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
if we have non fatal asserts configured.

Fix the null pointer dereference crash in __xfs_dir3_data_check by
looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
to bail out if it is fed a non-directory "parent".

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/libxfs/xfs_dir2_data.c |    7 +++++++
 fs/xfs/scrub/parent.c         |    2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Brian Foster Jan. 9, 2018, 4:09 p.m. UTC | #1 
On Mon, Jan 08, 2018 at 11:13:36PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> If a malicious filesystem image contains a block+ format directory
> wherein the directory inode's core.mode is set such that
> S_ISDIR(core.mode) == 0, and if there are subdirectories of the
> corrupted directory, an attempt to traverse up the directory tree will
> crash the kernel in __xfs_dir3_data_check.  Running the online scrub's
> parent checks will tend to do this.
> 
> The crash occurs because the directory inode's d_ops get set to
> xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
> scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
> if we have non fatal asserts configured.
> 
> Fix the null pointer dereference crash in __xfs_dir3_data_check by
> looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
> to bail out if it is fed a non-directory "parent".
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  fs/xfs/libxfs/xfs_dir2_data.c |    7 +++++++
>  fs/xfs/scrub/parent.c         |    2 +-
>  2 files changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
> index 3237812..31d5ec6 100644
> --- a/fs/xfs/libxfs/xfs_dir2_data.c
> +++ b/fs/xfs/libxfs/xfs_dir2_data.c
> @@ -73,6 +73,13 @@ __xfs_dir3_data_check(
>  	 */
>  	ops = xfs_dir_get_ops(mp, dp);
>  
> +	/*
> +	 * If this isn't a directory, or we got handed the non-dir ops,
> +	 * something is seriously wrong.  Bail out.
> +	 */
> +	if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
> +		return __this_address;
> +

I wonder if something like (ops == xfs_nondir_get_ops(mp, NULL)) would
be a bit more explicit for the second part of this check..? Otherwise
seems Ok to me.

Brian

>  	hdr = bp->b_addr;
>  	p = (char *)ops->data_entry_p(hdr);
>  
> diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
> index dd704fd..0d38514 100644
> --- a/fs/xfs/scrub/parent.c
> +++ b/fs/xfs/scrub/parent.c
> @@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
>  	error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
>  	if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
>  		goto out;
> -	if (dp == sc->ip) {
> +	if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
>  		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
>  		goto out_rele;
>  	}
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Darrick J. Wong Jan. 9, 2018, 6:25 p.m. UTC | #2 
On Tue, Jan 09, 2018 at 11:09:16AM -0500, Brian Foster wrote:
> On Mon, Jan 08, 2018 at 11:13:36PM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > If a malicious filesystem image contains a block+ format directory
> > wherein the directory inode's core.mode is set such that
> > S_ISDIR(core.mode) == 0, and if there are subdirectories of the
> > corrupted directory, an attempt to traverse up the directory tree will
> > crash the kernel in __xfs_dir3_data_check.  Running the online scrub's
> > parent checks will tend to do this.
> > 
> > The crash occurs because the directory inode's d_ops get set to
> > xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
> > scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
> > if we have non fatal asserts configured.
> > 
> > Fix the null pointer dereference crash in __xfs_dir3_data_check by
> > looking for S_ISDIR or NULL data_entry_p; and teach the parent scrubber
> > to bail out if it is fed a non-directory "parent".
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> >  fs/xfs/libxfs/xfs_dir2_data.c |    7 +++++++
> >  fs/xfs/scrub/parent.c         |    2 +-
> >  2 files changed, 8 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
> > index 3237812..31d5ec6 100644
> > --- a/fs/xfs/libxfs/xfs_dir2_data.c
> > +++ b/fs/xfs/libxfs/xfs_dir2_data.c
> > @@ -73,6 +73,13 @@ __xfs_dir3_data_check(
> >  	 */
> >  	ops = xfs_dir_get_ops(mp, dp);
> >  
> > +	/*
> > +	 * If this isn't a directory, or we got handed the non-dir ops,
> > +	 * something is seriously wrong.  Bail out.
> > +	 */
> > +	if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
> > +		return __this_address;
> > +
> 
> I wonder if something like (ops == xfs_nondir_get_ops(mp, NULL)) would
> be a bit more explicit for the second part of this check..? Otherwise
> seems Ok to me.

Sure, though I prefer (ops != xfs_dir_get_ops(mp, NULL)) for defensive
reasons.

--D

> 
> Brian
> 
> >  	hdr = bp->b_addr;
> >  	p = (char *)ops->data_entry_p(hdr);
> >  
> > diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
> > index dd704fd..0d38514 100644
> > --- a/fs/xfs/scrub/parent.c
> > +++ b/fs/xfs/scrub/parent.c
> > @@ -171,7 +171,7 @@ xfs_scrub_parent_validate(
> >  	error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
> >  	if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
> >  		goto out;
> > -	if (dp == sc->ip) {
> > +	if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
> >  		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
> >  		goto out_rele;
> >  	}
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index 3237812..31d5ec6 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -73,6 +73,13 @@  __xfs_dir3_data_check(
 	 */
 	ops = xfs_dir_get_ops(mp, dp);
 
+	/*
+	 * If this isn't a directory, or we got handed the non-dir ops,
+	 * something is seriously wrong.  Bail out.
+	 */
+	if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || !ops->data_entry_p)
+		return __this_address;
+
 	hdr = bp->b_addr;
 	p = (char *)ops->data_entry_p(hdr);
 
diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
index dd704fd..0d38514 100644
--- a/fs/xfs/scrub/parent.c
+++ b/fs/xfs/scrub/parent.c
@@ -171,7 +171,7 @@  xfs_scrub_parent_validate(
 	error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp);
 	if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
 		goto out;
-	if (dp == sc->ip) {
+	if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
 		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
 		goto out_rele;
 	}