From 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a Mon Sep 17 00:00:00 2001

From: Theodore Ts'o <tytso@mit.edu>

Date: Thu, 7 Nov 2019 21:43:41 -0500

Subject: [PATCH] ext4: add more paranoia checking in ext4_expand_extra_isize

 handling

Git-commit: 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a

Patch-mainline: v5.5-rc1

References: bsc#1159297 CVE-2019-19767

It's possible to specify a non-zero s_want_extra_isize via debugging

option, and this can cause bad things(tm) to happen when using a file

system with an inode size of 128 bytes.

Add better checking when the file system is mounted, as well as when

we are actually doing the trying to do the inode expansion.

Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu

Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com

Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com

Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Cc: stable@kernel.org

Acked-by: Jan Kara <jack@suse.cz>

---

 fs/ext4/inode.c |   15 +++++++++++++++

 fs/ext4/super.c |   21 ++++++++++++---------

 2 files changed, 27 insertions(+), 9 deletions(-)

--- a/fs/ext4/inode.c

+++ b/fs/ext4/inode.c

@@ -5736,6 +5736,21 @@ static int ext4_expand_extra_isize(struc

 {

 	struct ext4_inode *raw_inode;

 	struct ext4_xattr_ibody_header *header;

+	unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);

+	struct ext4_inode_info *ei = EXT4_I(inode);

+

+	/* this was checked at iget time, but double check for good measure */

+	if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||

+	    (ei->i_extra_isize & 3)) {

+		EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",

+				 ei->i_extra_isize,

+				 EXT4_INODE_SIZE(inode->i_sb));

+		return -EFSCORRUPTED;

+	}

+	if ((new_extra_isize < ei->i_extra_isize) ||

+	    (new_extra_isize < 4) ||

+	    (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))

+		return -EINVAL;	/* Should never happen */

 	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)

 		return 0;

--- a/fs/ext4/super.c

+++ b/fs/ext4/super.c

@@ -3429,12 +3429,15 @@ static void ext4_clamp_want_extra_isize(

 {

 	struct ext4_sb_info *sbi = EXT4_SB(sb);

 	struct ext4_super_block *es = sbi->s_es;

+	unsigned def_extra_isize = sizeof(struct ext4_inode) -

+						EXT4_GOOD_OLD_INODE_SIZE;

-	/* determine the minimum size of new large inodes, if present */

-	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&

-	    sbi->s_want_extra_isize == 0) {

-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

-						     EXT4_GOOD_OLD_INODE_SIZE;

+	if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {

+		sbi->s_want_extra_isize = 0;

+		return;

+	}

+	if (sbi->s_want_extra_isize < 4) {

+		sbi->s_want_extra_isize = def_extra_isize;

 		if (ext4_has_feature_extra_isize(sb)) {

 			if (sbi->s_want_extra_isize <

 			    le16_to_cpu(es->s_want_extra_isize))

@@ -3447,10 +3450,10 @@ static void ext4_clamp_want_extra_isize(

 		}

 	}

 	/* Check if enough inode space is available */

-	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

-							sbi->s_inode_size) {

-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

-						       EXT4_GOOD_OLD_INODE_SIZE;

+	if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||

+	    (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

+							sbi->s_inode_size)) {

+		sbi->s_want_extra_isize = def_extra_isize;

 		ext4_msg(sb, KERN_INFO,

 			 "required extra inode space not available");

 	}