linux-kernel - Re: [PATCH] gfs2: add bounds check for rd_length in compute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHc6FU4CVLe6ZxPR1Q3dc=5i1ARrNAjnB_NEK5_Y_Pecmk_4bQ@mail.gmail.com>
Date: Mon, 22 Sep 2025 13:34:36 +0200
From: Andreas Gruenbacher <agruenba@...hat.com>
To: Kriish Sharma <kriish.sharma2006@...il.com>
Cc: gfs2@...ts.linux.dev, linux-kernel@...r.kernel.org, 
	skhan@...uxfoundation.org, david.hunter.linux@...il.com, 
	linux-kernel-mentees@...ts.linux.dev, 
	syzbot+7567dc5c8aa8f68bde74@...kaller.appspotmail.com
Subject: Re: [PATCH] gfs2: add bounds check for rd_length in compute_bitstructs()

Kriish,

On Thu, Sep 18, 2025 at 10:49 PM Kriish Sharma
<kriish.sharma2006@...il.com> wrote:
> compute_bitstructs() allocates an array of gfs2_bitmap structures
> using kcalloc(). The function only checked for length == 0 but did not
> guard against excessively large length values.
>
> If rd_length is too large, the multiplication inside
> kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS) can exceed
> KMALLOC_MAX_SIZE. This leads to the allocator calculating an order
> greater than MAX_ORDER when calling get_order(), which is invalid.
> As a result, __alloc_pages() warns about the bad request.
>
> This patch adds an explicit check that rd_length is not only non-zero
> but also within the maximum safe limit for kmalloc_array():
>     length <= KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap)
>
> This ensures that get_order() is only ever called with a valid size,
> resulting in an allocation order within MAX_ORDER
>
> Fixes: b9158815de52 ("Merge tag 'char-misc-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc")
> Reported-by: syzbot+7567dc5c8aa8f68bde74@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74
>
> Signed-off-by: Kriish Sharma <kriish.sharma2006@...il.com>
> ---
>  fs/gfs2/rgrp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
> index 26d6c1eea559..a879e8030568 100644
> --- a/fs/gfs2/rgrp.c
> +++ b/fs/gfs2/rgrp.c
> @@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
>         u32 bytes_left, bytes;
>         int x;
>
> -       if (!length)
> +       if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap))
>                 return -EINVAL;
>
>         rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS);
> --
> 2.34.1
>

this patch looks correct at a certain level of abstraction, but a
better approach would be to sanity check the resource group fields in
read_rindex_entry(). Andy and I are trying to work out a patch that
does that.

Thanks,
Andreas