linux-ext4 - [PATCH] ext4: Fix WANRON caused by unconsistent boot loader inode's i_size and i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Mar 2023 11:26:43 +0800
From:   Zhihao Cheng <chengzhihao1@...wei.com>
To:     <jack@...e.com>, <tytso@....edu>, <adilger.kernel@...ger.ca>
CC:     <linux-ext4@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <chengzhihao1@...wei.com>, <yi.zhang@...wei.com>
Subject: [PATCH] ext4: Fix WANRON caused by unconsistent boot loader inode's i_size and i_disksize

Using corrupted ext4 image(non-zero i_size for boot loader inode) could
trigger WARNON 'i_size_read(inode) < EXT4_I(inode)->i_disksize' in
ext4_handle_inode_extension():

 WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319
 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa
 RIP: 0010:ext4_file_write_iter+0xbc7/0xd10
 Call Trace:
  vfs_write+0x3b1/0x5c0
  ksys_write+0x77/0x160
  __x64_sys_write+0x22/0x30
  do_syscall_64+0x39/0x80

Reproducer (See Link):
 1. mount corrupted ext4 image with non-zero i_size for boot loader inode
 2. ioctl(fd, EXT4_IOC_SWAP_BOOT)
 3. write(fd)  // O_DIRECT

Fix it by setting i_disksize while first loading boot loader inode.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217159
Cc: <stable@...nel.org>
Signed-off-by: Zhihao Cheng <chengzhihao1@...wei.com>
---
 fs/ext4/ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 12435d61f09e..f9a430152063 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -431,6 +431,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
 		ei_bl->i_flags = 0;
 		inode_set_iversion(inode_bl, 1);
 		i_size_write(inode_bl, 0);
+		EXT4_I(inode_bl)->i_disksize = inode_bl->i_size;
 		inode_bl->i_mode = S_IFREG;
 		if (ext4_has_feature_extents(sb)) {
 			ext4_set_inode_flag(inode_bl, EXT4_INODE_EXTENTS);
-- 
2.31.1