From patchwork Mon Jan 20 13:11:43 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Denis Arefev X-Patchwork-Id: 13945094 Received: from mx.swemel.ru (mx.swemel.ru [95.143.211.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9C661E0E07; Mon, 20 Jan 2025 13:11:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.143.211.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737378709; cv=none; b=Sst7/OwaQ3QJRaO/AumQLQHFHmJD/b0LBUyuxHqnNqBNtaV9lT8Eiy74n6vMtAycKwsZbnchlAPgI1sEde/NRxz/jZY1tB49mglx3LlRSRkOeCtNIupD7Gi4+4Ia4DRvHxVsWfv/S4+Tfy6BQzXOF6V1xy1h7glVejP1kInSqtA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737378709; c=relaxed/simple; bh=j8n0lhPwozEF5mJltErcdu7MzBnBbbc/Nt0TogD/GrY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GMmiyZo7OXEkz0aFhqAbdrw44Wz8onTILxlhx3K905Ak4K+7fEyZjSpmiHbCjrKSoFeyVCkT88mT9esIL+OapQueT1zTfrINnz+Uc8qxuSLFDPzWs3y4oYQJs6iJSVxKdwtWjNHs59mpprAnMHvro70VAfoOvp3zSYT21hxVbsw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=swemel.ru; spf=pass smtp.mailfrom=swemel.ru; dkim=pass (1024-bit key) header.d=swemel.ru header.i=@swemel.ru header.b=f9LdA8b7; arc=none smtp.client-ip=95.143.211.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=swemel.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=swemel.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=swemel.ru header.i=@swemel.ru header.b="f9LdA8b7" From: Denis Arefev DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=swemel.ru; s=mail; t=1737378704; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=kgQPI+dNQX5S/d0yPfZSHZR915JjJBF9kW4q/ixBVA0=; b=f9LdA8b7v6MSGh7BU/HowFhKAigEspScXw1+OfWMxtCcagXWe4DSGkL+E1m+7kstjED6sZ 0SRpxHuTHAKD5+RjRLekGcuHb6jYUydMxWlOrlpAvG7z9ZMpgNKYdTHPcRrCYAo5BiIREQ EC/OaRxorHyFl8OsX3QgxQuw42FtKyU= To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Amir Goldstein , "Darrick J. Wong" , linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org, lei lu , Dave Chinner , Chandan Babu R Subject: [PATCH 5.10] xfs: add bounds checking to xlog_recover_process_data Date: Mon, 20 Jan 2025 16:11:43 +0300 Message-ID: <20250120131144.52763-1-arefev@swemel.ru> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: lei lu commit fb63435b7c7dc112b1ae1baea5486e0a6e27b196 upstream. There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header. Signed-off-by: lei lu Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R Signed-off-by: Denis Arefev --- Backport fix for CVE-2024-41014 Link: https://nvd.nist.gov/vuln/detail/cve-2024-41014 --- fs/xfs/xfs_log_recover.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index e61f28ce3e44..eafe76f304ef 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2419,7 +2419,10 @@ xlog_recover_process_data( ohead = (struct xlog_op_header *)dp; dp += sizeof(*ohead); - ASSERT(dp <= end); + if (dp > end) { + xfs_warn(log->l_mp, "%s: op header overrun", __func__); + return -EFSCORRUPTED; + } /* errors will abort recovery */ error = xlog_recover_process_ophdr(log, rhash, rhead, ohead,