Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45df749f authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Greg Kroah-Hartman
Browse files

gfs2: Always check inode size of inline inodes 



commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream.

Check if the inode size of stuffed (inline) inodes is within the allowed
range when reading inodes from disk (gfs2_dinode_in()).  This prevents
us from on-disk corruption.

The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just
truncate inline data to the maximum allowed size don't actually make
sense, and they can be removed now as well.

Reported-by: default avatar <syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
[pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with
the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic
gfs2_dinode_{in,out} cleanup")]
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 51a8f136

fs/gfs2/aops.c

+0 −2
Original line number Diff line number Diff line
@@ -480,8 +480,6 @@ int stuffed_readpage(struct gfs2_inode *ip, struct page *page) 
		return error;



	kaddr = kmap_atomic(page);

	if (dsize > gfs2_max_stuffed_size(ip))

		dsize = gfs2_max_stuffed_size(ip);

	memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);

	memset(kaddr + dsize, 0, PAGE_SIZE - dsize);

	kunmap_atomic(kaddr);

fs/gfs2/bmap.c

+0 −3
Original line number Diff line number Diff line
@@ -72,9 +72,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, 
		void *kaddr = kmap(page);

		u64 dsize = i_size_read(inode);

 

		if (dsize > gfs2_max_stuffed_size(ip))

			dsize = gfs2_max_stuffed_size(ip);



		memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);

		memset(kaddr + dsize, 0, PAGE_SIZE - dsize);

		kunmap(page);

fs/gfs2/glops.c

+3 −0
Original line number Diff line number Diff line
@@ -388,6 +388,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) 
	ip->i_depth = (u8)depth;

	ip->i_entries = be32_to_cpu(str->di_entries);



	if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip))

		goto corrupt;



	if (S_ISREG(ip->i_inode.i_mode))

		gfs2_set_aops(&ip->i_inode);