From patchwork Tue Jan 9 18:47:29 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darrick J. Wong" X-Patchwork-Id: 10153047 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B26CB602CA for ; Tue, 9 Jan 2018 18:53:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AAA6A28717 for ; Tue, 9 Jan 2018 18:53:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9F5912871D; Tue, 9 Jan 2018 18:53:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 04FBF28717 for ; Tue, 9 Jan 2018 18:53:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753407AbeAISxE (ORCPT ); Tue, 9 Jan 2018 13:53:04 -0500 Received: from aserp2120.oracle.com ([141.146.126.78]:38768 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760459AbeAISxD (ORCPT ); Tue, 9 Jan 2018 13:53:03 -0500 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w09IptDY167624; Tue, 9 Jan 2018 18:52:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=corp-2017-10-26; bh=RNauhow0KS9tsPxLo2TMx4wQlCrLjaOCt2k2MEk+K+4=; b=ltaU68Zcy3q1FIwQ8K1E4NR3jy3KYRldk4yVuC+epPO5R14v4pcXTes+WlxWcYnyga3C vQg2a4bMutwkhyAS1D4e2LNWE8qoE3soLmIFDq6UlFbmbm/a+B+fSN3/DZJcINnlB7Dm QHbCsP7q3/0dSw6RJt7qH2E/U8tnhBqsA8c1DjPeAPZKZGpSUYrKg1eoojks5uEARxfV Kb/OP79f9ID0atE+LRM01FdYsl18lyNKU6bgvA14B4YN+G4W8y+Nrwxxe5ivwvWg24sQ pAs8y4G8Hb22AmFz46/gvQtWq59IHY0A5vADlZAKeq3Fe3lz2Nj7EoZCLQZdH0OWCEEf rw== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp2120.oracle.com with ESMTP id 2fd3c880p9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 09 Jan 2018 18:52:31 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w09IlVB5020862 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 9 Jan 2018 18:47:31 GMT Received: from abhmp0008.oracle.com (abhmp0008.oracle.com [141.146.116.14]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w09IlUK7008117; Tue, 9 Jan 2018 18:47:31 GMT Received: from localhost (/67.169.218.210) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 09 Jan 2018 10:47:30 -0800 Date: Tue, 9 Jan 2018 10:47:29 -0800 From: "Darrick J. Wong" To: xfs Cc: Brian Foster Subject: [PATCH v2] xfs: harden directory integrity checks some more Message-ID: <20180109184729.GF5602@magnolia> References: <20180109071336.GD5602@magnolia> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20180109071336.GD5602@magnolia> User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8769 signatures=668652 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=798 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1801090261 Sender: linux-xfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Darrick J. Wong If a malicious filesystem image contains a block+ format directory wherein the directory inode's core.mode is set such that S_ISDIR(core.mode) == 0, and if there are subdirectories of the corrupted directory, an attempt to traverse up the directory tree will crash the kernel in __xfs_dir3_data_check. Running the online scrub's parent checks will tend to do this. The crash occurs because the directory inode's d_ops get set to xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT if we have non fatal asserts configured. Fix the null pointer dereference crash in __xfs_dir3_data_check by looking for S_ISDIR or wrong d_ops; and teach the parent scrubber to bail out if it is fed a non-directory "parent". Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster --- v2: check for wrong d_ops, not individual function pointers --- fs/xfs/libxfs/xfs_dir2_data.c | 8 ++++++++ fs/xfs/scrub/parent.c | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe linux-xfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c index 3237812..853d9ab 100644 --- a/fs/xfs/libxfs/xfs_dir2_data.c +++ b/fs/xfs/libxfs/xfs_dir2_data.c @@ -73,6 +73,14 @@ __xfs_dir3_data_check( */ ops = xfs_dir_get_ops(mp, dp); + /* + * If this isn't a directory, or we don't get handed the dir ops, + * something is seriously wrong. Bail out. + */ + if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || + ops != xfs_dir_get_ops(mp, NULL)) + return __this_address; + hdr = bp->b_addr; p = (char *)ops->data_entry_p(hdr); diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c index dd704fd..0d38514 100644 --- a/fs/xfs/scrub/parent.c +++ b/fs/xfs/scrub/parent.c @@ -171,7 +171,7 @@ xfs_scrub_parent_validate( error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp); if (!xfs_scrub_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error)) goto out; - if (dp == sc->ip) { + if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) { xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0); goto out_rele; }