Home Home > GIT Browse > SLE15
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony Iliopoulos <ailiopoulos@suse.com>2019-05-17 17:20:15 +0200
committerAnthony Iliopoulos <ailiopoulos@suse.com>2019-05-17 17:20:15 +0200
commitd9d191e60bf17aff81948efcd17321c5e27b654a (patch)
treee05f2647d71c03052e31d3352b7538aab4b9f54f
parent59af3d528725871a42229f6e84776d4af03a463b (diff)
xfs: sanity-check the unused space before trying to use it
(bsc#1123663).
-rw-r--r--patches.fixes/xfs-sanity-check-the-unused-space-before-trying-to-u.patch321
-rw-r--r--series.conf1
2 files changed, 322 insertions, 0 deletions
diff --git a/patches.fixes/xfs-sanity-check-the-unused-space-before-trying-to-u.patch b/patches.fixes/xfs-sanity-check-the-unused-space-before-trying-to-u.patch
new file mode 100644
index 0000000000..9f1ce38986
--- /dev/null
+++ b/patches.fixes/xfs-sanity-check-the-unused-space-before-trying-to-u.patch
@@ -0,0 +1,321 @@
+From 6915ef35c0350e87a104cb4c4ab2121c81ca7a34 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Fri, 23 Mar 2018 10:06:51 -0700
+Subject: [PATCH] xfs: sanity-check the unused space before trying to use it
+Git-commit: 6915ef35c0350e87a104cb4c4ab2121c81ca7a34
+Patch-mainline: v4.17-rc1
+References: bsc#1123663
+
+In xfs_dir2_data_use_free, we examine on-disk metadata and ASSERT if
+it doesn't make sense. Since a carefully crafted fuzzed image can cause
+the kernel to crash after blowing a bunch of assertions, let's move
+those checks into a validator function and rig everything up to return
+EFSCORRUPTED to userspace. Found by lastbit fuzzing ltail.bestcount via
+xfs/391.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/libxfs/xfs_dir2.h | 2 -
+ fs/xfs/libxfs/xfs_dir2_block.c | 59 ++++++++++++++++++-------------
+ fs/xfs/libxfs/xfs_dir2_data.c | 78 +++++++++++++++++++++++++++++++----------
+ fs/xfs/libxfs/xfs_dir2_leaf.c | 10 +++--
+ fs/xfs/libxfs/xfs_dir2_node.c | 11 ++++-
+ 5 files changed, 111 insertions(+), 49 deletions(-)
+
+--- a/fs/xfs/libxfs/xfs_dir2.h
++++ b/fs/xfs/libxfs/xfs_dir2.h
+@@ -173,7 +173,7 @@
+ extern void xfs_dir2_data_make_free(struct xfs_da_args *args,
+ struct xfs_buf *bp, xfs_dir2_data_aoff_t offset,
+ xfs_dir2_data_aoff_t len, int *needlogp, int *needscanp);
+-extern void xfs_dir2_data_use_free(struct xfs_da_args *args,
++extern int xfs_dir2_data_use_free(struct xfs_da_args *args,
+ struct xfs_buf *bp, struct xfs_dir2_data_unused *dup,
+ xfs_dir2_data_aoff_t offset, xfs_dir2_data_aoff_t len,
+ int *needlogp, int *needscanp);
+--- a/fs/xfs/libxfs/xfs_dir2_block.c
++++ b/fs/xfs/libxfs/xfs_dir2_block.c
+@@ -450,15 +450,19 @@
+ * No stale entries, will use enddup space to hold new leaf.
+ */
+ if (!btp->stale) {
++ xfs_dir2_data_aoff_t aoff;
++
+ /*
+ * Mark the space needed for the new leaf entry, now in use.
+ */
+- xfs_dir2_data_use_free(args, bp, enddup,
+- (xfs_dir2_data_aoff_t)
+- ((char *)enddup - (char *)hdr + be16_to_cpu(enddup->length) -
+- sizeof(*blp)),
+- (xfs_dir2_data_aoff_t)sizeof(*blp),
+- &needlog, &needscan);
++ aoff = (xfs_dir2_data_aoff_t)((char *)enddup - (char *)hdr +
++ be16_to_cpu(enddup->length) - sizeof(*blp));
++ error = xfs_dir2_data_use_free(args, bp, enddup, aoff,
++ (xfs_dir2_data_aoff_t)sizeof(*blp), &needlog,
++ &needscan);
++ if (error)
++ return error;
++
+ /*
+ * Update the tail (entry count).
+ */
+@@ -540,9 +544,11 @@
+ /*
+ * Mark space for the data entry used.
+ */
+- xfs_dir2_data_use_free(args, bp, dup,
+- (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr),
+- (xfs_dir2_data_aoff_t)len, &needlog, &needscan);
++ error = xfs_dir2_data_use_free(args, bp, dup,
++ (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr),
++ (xfs_dir2_data_aoff_t)len, &needlog, &needscan);
++ if (error)
++ return error;
+ /*
+ * Create the new data entry.
+ */
+@@ -996,8 +1002,10 @@
+ /*
+ * Use up the space at the end of the block (blp/btp).
+ */
+- xfs_dir2_data_use_free(args, dbp, dup, args->geo->blksize - size, size,
+- &needlog, &needscan);
++ error = xfs_dir2_data_use_free(args, dbp, dup,
++ args->geo->blksize - size, size, &needlog, &needscan);
++ if (error)
++ return error;
+ /*
+ * Initialize the block tail.
+ */
+@@ -1109,18 +1117,14 @@
+ * Add block 0 to the inode.
+ */
+ error = xfs_dir2_grow_inode(args, XFS_DIR2_DATA_SPACE, &blkno);
+- if (error) {
+- kmem_free(sfp);
+- return error;
+- }
++ if (error)
++ goto out_free;
+ /*
+ * Initialize the data block, then convert it to block format.
+ */
+ error = xfs_dir3_data_init(args, blkno, &bp);
+- if (error) {
+- kmem_free(sfp);
+- return error;
+- }
++ if (error)
++ goto out_free;
+ xfs_dir3_block_init(mp, tp, bp, dp);
+ hdr = bp->b_addr;
+
+@@ -1135,8 +1139,10 @@
+ */
+ dup = dp->d_ops->data_unused_p(hdr);
+ needlog = needscan = 0;
+- xfs_dir2_data_use_free(args, bp, dup, args->geo->blksize - i,
+- i, &needlog, &needscan);
++ error = xfs_dir2_data_use_free(args, bp, dup, args->geo->blksize - i,
++ i, &needlog, &needscan);
++ if (error)
++ goto out_free;
+ ASSERT(needscan == 0);
+ /*
+ * Fill in the tail.
+@@ -1149,9 +1155,11 @@
+ /*
+ * Remove the freespace, we'll manage it.
+ */
+- xfs_dir2_data_use_free(args, bp, dup,
+- (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr),
+- be16_to_cpu(dup->length), &needlog, &needscan);
++ error = xfs_dir2_data_use_free(args, bp, dup,
++ (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr),
++ be16_to_cpu(dup->length), &needlog, &needscan);
++ if (error)
++ goto out_free;
+ /*
+ * Create entry for .
+ */
+@@ -1255,4 +1263,7 @@
+ xfs_dir2_block_log_tail(tp, bp);
+ xfs_dir3_data_check(dp, bp);
+ return 0;
++out_free:
++ kmem_free(sfp);
++ return error;
+ }
+--- a/fs/xfs/libxfs/xfs_dir2_data.c
++++ b/fs/xfs/libxfs/xfs_dir2_data.c
+@@ -910,10 +910,51 @@
+ *needscanp = needscan;
+ }
+
++/* Check our free data for obvious signs of corruption. */
++static inline xfs_failaddr_t
++xfs_dir2_data_check_free(
++ struct xfs_dir2_data_hdr *hdr,
++ struct xfs_dir2_data_unused *dup,
++ xfs_dir2_data_aoff_t offset,
++ xfs_dir2_data_aoff_t len)
++{
++ if (hdr->magic != cpu_to_be32(XFS_DIR2_DATA_MAGIC) &&
++ hdr->magic != cpu_to_be32(XFS_DIR3_DATA_MAGIC) &&
++ hdr->magic != cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) &&
++ hdr->magic != cpu_to_be32(XFS_DIR3_BLOCK_MAGIC))
++ return __this_address;
++ if (be16_to_cpu(dup->freetag) != XFS_DIR2_DATA_FREE_TAG)
++ return __this_address;
++ if (offset < (char *)dup - (char *)hdr)
++ return __this_address;
++ if (offset + len > (char *)dup + be16_to_cpu(dup->length) - (char *)hdr)
++ return __this_address;
++ if ((char *)dup - (char *)hdr !=
++ be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)))
++ return __this_address;
++ return NULL;
++}
++
++/* Sanity-check a new bestfree entry. */
++static inline xfs_failaddr_t
++xfs_dir2_data_check_new_free(
++ struct xfs_dir2_data_hdr *hdr,
++ struct xfs_dir2_data_free *dfp,
++ struct xfs_dir2_data_unused *newdup)
++{
++ if (dfp == NULL)
++ return __this_address;
++ if (dfp->length != newdup->length)
++ return __this_address;
++ if (be16_to_cpu(dfp->offset) != (char *)newdup - (char *)hdr)
++ return __this_address;
++ return NULL;
++}
++
+ /*
+ * Take a byte range out of an existing unused space and make it un-free.
+ */
+-void
++int
+ xfs_dir2_data_use_free(
+ struct xfs_da_args *args,
+ struct xfs_buf *bp,
+@@ -925,23 +966,19 @@
+ {
+ xfs_dir2_data_hdr_t *hdr; /* data block header */
+ xfs_dir2_data_free_t *dfp; /* bestfree pointer */
++ xfs_dir2_data_unused_t *newdup; /* new unused entry */
++ xfs_dir2_data_unused_t *newdup2; /* another new unused entry */
++ struct xfs_dir2_data_free *bf;
++ xfs_failaddr_t fa;
+ int matchback; /* matches end of freespace */
+ int matchfront; /* matches start of freespace */
+ int needscan; /* need to regen bestfree */
+- xfs_dir2_data_unused_t *newdup; /* new unused entry */
+- xfs_dir2_data_unused_t *newdup2; /* another new unused entry */
+ int oldlen; /* old unused entry's length */
+- struct xfs_dir2_data_free *bf;
+
+ hdr = bp->b_addr;
+- ASSERT(hdr->magic == cpu_to_be32(XFS_DIR2_DATA_MAGIC) ||
+- hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
+- hdr->magic == cpu_to_be32(XFS_DIR2_BLOCK_MAGIC) ||
+- hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC));
+- ASSERT(be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG);
+- ASSERT(offset >= (char *)dup - (char *)hdr);
+- ASSERT(offset + len <= (char *)dup + be16_to_cpu(dup->length) - (char *)hdr);
+- ASSERT((char *)dup - (char *)hdr == be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)));
++ fa = xfs_dir2_data_check_free(hdr, dup, offset, len);
++ if (fa)
++ goto corrupt;
+ /*
+ * Look up the entry in the bestfree table.
+ */
+@@ -986,9 +1023,9 @@
+ xfs_dir2_data_freeremove(hdr, bf, dfp, needlogp);
+ dfp = xfs_dir2_data_freeinsert(hdr, bf, newdup,
+ needlogp);
+- ASSERT(dfp != NULL);
+- ASSERT(dfp->length == newdup->length);
+- ASSERT(be16_to_cpu(dfp->offset) == (char *)newdup - (char *)hdr);
++ fa = xfs_dir2_data_check_new_free(hdr, dfp, newdup);
++ if (fa)
++ goto corrupt;
+ /*
+ * If we got inserted at the last slot,
+ * that means we don't know if there was a better
+@@ -1014,9 +1051,9 @@
+ xfs_dir2_data_freeremove(hdr, bf, dfp, needlogp);
+ dfp = xfs_dir2_data_freeinsert(hdr, bf, newdup,
+ needlogp);
+- ASSERT(dfp != NULL);
+- ASSERT(dfp->length == newdup->length);
+- ASSERT(be16_to_cpu(dfp->offset) == (char *)newdup - (char *)hdr);
++ fa = xfs_dir2_data_check_new_free(hdr, dfp, newdup);
++ if (fa)
++ goto corrupt;
+ /*
+ * If we got inserted at the last slot,
+ * that means we don't know if there was a better
+@@ -1062,4 +1099,9 @@
+ }
+ }
+ *needscanp = needscan;
++ return 0;
++corrupt:
++ xfs_corruption_error(__func__, XFS_ERRLEVEL_LOW, args->dp->i_mount,
++ hdr, __FILE__, __LINE__, fa);
++ return -EFSCORRUPTED;
+ }
+--- a/fs/xfs/libxfs/xfs_dir2_leaf.c
++++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
+@@ -850,9 +850,13 @@
+ /*
+ * Mark the initial part of our freespace in use for the new entry.
+ */
+- xfs_dir2_data_use_free(args, dbp, dup,
+- (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr), length,
+- &needlog, &needscan);
++ error = xfs_dir2_data_use_free(args, dbp, dup,
++ (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr),
++ length, &needlog, &needscan);
++ if (error) {
++ xfs_trans_brelse(tp, lbp);
++ return error;
++ }
+ /*
+ * Initialize our new entry (at last).
+ */
+--- a/fs/xfs/libxfs/xfs_dir2_node.c
++++ b/fs/xfs/libxfs/xfs_dir2_node.c
+@@ -1713,6 +1713,7 @@
+ __be16 *bests;
+ struct xfs_dir3_icfree_hdr freehdr;
+ struct xfs_dir2_data_free *bf;
++ xfs_dir2_data_aoff_t aoff;
+
+ dp = args->dp;
+ mp = dp->i_mount;
+@@ -2007,9 +2008,13 @@
+ /*
+ * Mark the first part of the unused space, inuse for us.
+ */
+- xfs_dir2_data_use_free(args, dbp, dup,
+- (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr), length,
+- &needlog, &needscan);
++ aoff = (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr);
++ error = xfs_dir2_data_use_free(args, dbp, dup, aoff, length,
++ &needlog, &needscan);
++ if (error) {
++ xfs_trans_brelse(tp, dbp);
++ return error;
++ }
+ /*
+ * Fill in the new entry and log it.
+ */
diff --git a/series.conf b/series.conf
index 40dcfadd23..c448c25e1f 100644
--- a/series.conf
+++ b/series.conf
@@ -14911,6 +14911,7 @@
patches.fixes/xfs-convert-XFS_AGFL_SIZE-to-a-helper-function.patch
patches.fixes/xfs-remove-xfs_zero_range.patch
patches.fixes/xfs-detect-agfl-count-corruption-and-reset-agfl.patch
+ patches.fixes/xfs-sanity-check-the-unused-space-before-trying-to-u.patch
patches.fixes/xfs-catch-inode-allocation-state-mismatch-corruption.patch
patches.suse/btrfs-do-not-check-inode-s-runtime-flags-under-root-orphan_lock.patch
patches.suse/0014-btrfs-tree-checker-Replace-root-parameter-with-fs_in.patch