linux-kernel - [PATCH] bfs: validate inode vtype and discard invalid entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20241123172453.275255-1-kovalev@altlinux.org>
Date: Sat, 23 Nov 2024 20:24:53 +0300
From: Vasiliy Kovalev <kovalev@...linux.org>
To: "Tigran A . Aivazian" <aivazian.tigran@...il.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org,
	linux-unionfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: kovalev@...linux.org
Subject: [PATCH] bfs: validate inode vtype and discard invalid entries

The inode's `i_mode` field previously included all 16 bits from the
BFS on-disk mode, which combines permission bits (0-11) with file type
bits (12-15).
However, this approach allowed invalid type bits to propagate, leading
to inodes with uninitialized or incorrect fields.

As Al Viro noted [1], file types are determined by bits 12-15, which
correspond to:
- `0x4000` for directories,
- `0x8000` for regular files,
- other values for different types like FIFOs or symlinks.

If the `i_vtype` field does not match a valid file type (e.g., `BFS_VDIR`
or `BFS_VREG`), it indicates corruption or an unsupported state in the
filesystem.

This patch restricts `i_mode` to the lower 12 bits and validates `i_vtype`:
- Directories and regular files are handled as expected.
- Inodes with invalid `i_vtype` values are discarded, and a warning is
logged for debugging.

[1] https://lore.kernel.org/linux-unionfs/20241123002157.GP3387508@ZenIV/

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a8c9d476508bd14a90e5@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5
Suggested-by: Al Viro <viro@...iv.linux.org.uk>
Cc: <stable@...r.kernel.org>
Signed-off-by: Vasiliy Kovalev <kovalev@...linux.org>
---
 fs/bfs/inode.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index db81570c96375..c02efc5724d26 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -60,7 +60,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 	off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
 	di = (struct bfs_inode *)bh->b_data + off;
 
-	inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
+	inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
 	if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
 		inode->i_mode |= S_IFDIR;
 		inode->i_op = &bfs_dir_inops;
@@ -70,6 +70,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 		inode->i_op = &bfs_file_inops;
 		inode->i_fop = &bfs_file_operations;
 		inode->i_mapping->a_ops = &bfs_aops;
+	} else {
+		printf("Invalid vtype %u for inode %s:%08lx\n",
+			le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
+		brelse(bh);
+		goto error;
 	}
 
 	BFS_I(inode)->i_sblock =  le32_to_cpu(di->i_sblock);
-- 
2.33.8