Commit 70376c7f authored Dec 04, 2022 by Andreas Gruenbacher

gfs2: Always check inode size of inline inodes



Check if the inode size of stuffed (inline) inodes is within the allowed
range when reading inodes from disk (gfs2_dinode_in()).  This prevents
us from on-disk corruption.

The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just
truncate inline data to the maximum allowed size don't actually make
sense, and they can be removed now as well.

Reported-by:  <syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>

parent 7db35444

fs/gfs2/aops.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -427,8 +427,6 @@ static int stuffed_readpage(struct gfs2_inode ip, struct page page)
		return error;

		kaddr = kmap_atomic(page);
		if (dsize > gfs2_max_stuffed_size(ip))
		dsize = gfs2_max_stuffed_size(ip);
		memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
		memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
		kunmap_atomic(kaddr);

fs/gfs2/bmap.c

+0 −3

Original line number	Diff line number	Diff line
		@@ -61,9 +61,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode ip, struct buffer_head dibh,
		void *kaddr = kmap(page);
		u64 dsize = i_size_read(inode);

		if (dsize > gfs2_max_stuffed_size(ip))
		dsize = gfs2_max_stuffed_size(ip);

		memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
		memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
		kunmap(page);

fs/gfs2/glops.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -449,6 +449,9 @@ static int gfs2_dinode_in(struct gfs2_inode ip, const void buf)
		ip->i_depth = (u8)depth;
		ip->i_entries = be32_to_cpu(str->di_entries);

		if (gfs2_is_stuffed(ip) && inode->i_size > gfs2_max_stuffed_size(ip))
		goto corrupt;

		if (S_ISREG(inode->i_mode))
		gfs2_set_aops(inode);