Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eca93bf2 authored by Phillip Lougher's avatar Phillip Lougher Committed by Greg Kroah-Hartman
Browse files

squashfs: add more sanity checks in xattr id lookup 

commit 506220d2ba21791314af569211ffd8870b8208fa upstream.

Sysbot has reported a warning where a kmalloc() attempt exceeds the
maximum limit.  This has been identified as corruption of the xattr_ids
count when reading the xattr id lookup table.

This patch adds a number of additional sanity checks to detect this
corruption and others.

1. It checks for a corrupted xattr index read from the inode.  This could
   be because the metadata block is uncompressed, or because the
   "compression" bit has been corrupted (turning a compressed block
   into an uncompressed block).  This would cause an out of bounds read.

2. It checks against corruption of the xattr_ids count.  This can either
   lead to the above kmalloc failure, or a smaller than expected
   table to be read.

3. It checks the contents of the index table for corruption.

[phillip@squashfs.org.uk: fix checkpatch issue]
  Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk

Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk


Signed-off-by: default avatarPhillip Lougher <phillip@squashfs.org.uk>
Reported-by: default avatar <syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a19f1bf0

fs/squashfs/xattr_id.c

+57 −9
Original line number Diff line number Diff line
@@ -44,10 +44,15 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index, 
	struct squashfs_sb_info *msblk = sb->s_fs_info;

	int block = SQUASHFS_XATTR_BLOCK(index);

	int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index);

	u64 start_block = le64_to_cpu(msblk->xattr_id_table[block]);

	u64 start_block;

	struct squashfs_xattr_id id;

	int err;



	if (index >= msblk->xattr_ids)

		return -EINVAL;



	start_block = le64_to_cpu(msblk->xattr_id_table[block]);



	err = squashfs_read_metadata(sb, &id, &start_block, &offset,

							sizeof(id));

	if (err < 0)
@@ -63,13 +68,17 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index, 
/*

 * Read uncompressed xattr id lookup table indexes from disk into memory

 */

__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start,

__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,

		u64 *xattr_table_start, int *xattr_ids)

{

	unsigned int len;

	struct squashfs_sb_info *msblk = sb->s_fs_info;

	unsigned int len, indexes;

	struct squashfs_xattr_id_table *id_table;

	__le64 *table;

	u64 start, end;

	int n;



	id_table = squashfs_read_table(sb, start, sizeof(*id_table));

	id_table = squashfs_read_table(sb, table_start, sizeof(*id_table));

	if (IS_ERR(id_table))

		return (__le64 *) id_table;
@@ -83,13 +92,52 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start, 
	if (*xattr_ids == 0)

		return ERR_PTR(-EINVAL);



	/* xattr_table should be less than start */

	if (*xattr_table_start >= start)

	len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);

	indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);



	/*

	 * The computed size of the index table (len bytes) should exactly

	 * match the table start and end points

	 */

	start = table_start + sizeof(*id_table);

	end = msblk->bytes_used;



	if (len != (end - start))

		return ERR_PTR(-EINVAL);



	len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);

	table = squashfs_read_table(sb, start, len);

	if (IS_ERR(table))

		return table;



	TRACE("In read_xattr_index_table, length %d\n", len);

	/* table[0], table[1], ... table[indexes - 1] store the locations

	 * of the compressed xattr id blocks.  Each entry should be less than

	 * the next (i.e. table[0] < table[1]), and the difference between them

	 * should be SQUASHFS_METADATA_SIZE or less.  table[indexes - 1]

	 * should be less than table_start, and again the difference

	 * shouls be SQUASHFS_METADATA_SIZE or less.

	 *

	 * Finally xattr_table_start should be less than table[0].

	 */

	for (n = 0; n < (indexes - 1); n++) {

		start = le64_to_cpu(table[n]);

		end = le64_to_cpu(table[n + 1]);



		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {

			kfree(table);

			return ERR_PTR(-EINVAL);

		}

	}



	start = le64_to_cpu(table[indexes - 1]);

	if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {

		kfree(table);

		return ERR_PTR(-EINVAL);

	}



	if (*xattr_table_start >= le64_to_cpu(table[0])) {

		kfree(table);

		return ERR_PTR(-EINVAL);

	}



	return squashfs_read_table(sb, start + sizeof(*id_table), len);

	return table;

}