Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 504cf969 authored by Eric Biggers's avatar Eric Biggers Committed by Greg Kroah-Hartman
Browse files

fs-verity: fix signed integer overflow with i_size near S64_MAX 

commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream.

If the file size is almost S64_MAX, the calculated number of Merkle tree
levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to
fail.  This is unintentional, since as the comment above the definition
of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of
data using SHA-256 and 4K blocks.  (Specifically, 4096*128**8 >= 2**64.)

The bug is actually that when the number of blocks in the first level is
calculated from i_size, there is a signed integer overflow due to i_size
being signed.  Fix this by treating i_size as unsigned.

This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io

).

This didn't affect ext4 or f2fs since those have a smaller maximum file
size, but it did affect btrfs which allows files up to S64_MAX bytes.

Reported-by: default avatarBoris Burkov <boris@bur.io>
Fixes: 3fda4c61 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl")
Fixes: fd2d1acf ("fs-verity: add the hook for file ->open()")
Cc: <stable@vger.kernel.org> # v5.4+
Reviewed-by: default avatarBoris Burkov <boris@bur.io>
Link: https://lore.kernel.org/r/20210916203424.113376-1-ebiggers@kernel.org


Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b2fb6ce0

fs/verity/enable.c

+1 −1
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ static int build_merkle_tree(struct inode *inode, 
	 * (level 0) and ascending to the root node (level 'num_levels - 1').

	 * Then at the end (level 'num_levels'), calculate the root hash.

	 */

	blocks = (inode->i_size + params->block_size - 1) >>

	blocks = ((u64)inode->i_size + params->block_size - 1) >>

		 params->log_blocksize;

	for (level = 0; level <= params->num_levels; level++) {

		err = build_merkle_tree_level(inode, level, blocks, params,

fs/verity/open.c

+1 −1
Original line number Diff line number Diff line
@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, 
	 */



	/* Compute number of levels and the number of blocks in each level */

	blocks = (inode->i_size + params->block_size - 1) >> log_blocksize;

	blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize;

	pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);

	while (blocks > 1) {

		if (params->num_levels >= FS_VERITY_MAX_LEVELS) {