linux-kernel - [PATCH v3] ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251117114224.12948-1-kartikey406@gmail.com>
Date: Mon, 17 Nov 2025 17:12:24 +0530
From: Deepanshu Kartikey <kartikey406@...il.com>
To: mark@...heh.com,
	jlbec@...lplan.org,
	joseph.qi@...ux.alibaba.com,
	ocfs2-devel@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Cc: Deepanshu Kartikey <kartikey406@...il.com>,
	syzbot+ab0ad25088673470d2d9@...kaller.appspotmail.com,
	Heming Zhao <heming.zhao@...e.com>
Subject: [PATCH v3] ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody_list

Add comprehensive validation of inline xattr metadata in
ocfs2_xattr_ibody_list() to prevent out-of-bounds access and
use-after-free bugs when processing corrupted inline xattrs.

The patch adds two critical validations:

1. Validates i_xattr_inline_size before use:
   - Ensures it does not exceed block size
   - Ensures it is at least large enough for xattr header
   - Prevents pointer arithmetic with corrupted size values that could
     point outside the inode block

2. Validates xattr entry count (xh_count):
   - Calculates maximum entries that can fit in the inline space
   - Rejects counts that exceed this limit
   - Prevents out-of-bounds array access in subsequent code

Without these checks, a corrupted filesystem with invalid inline xattr
metadata can cause the code to access memory beyond the allocated space.
For example:
- A corrupted i_xattr_inline_size of 0 would cause header pointer
  calculation to point past the end of the block
- A corrupted xh_count of 20041 with inline_size of 256 would cause
  array access beyond the 7 entries that actually fit, leading to
  use-after-free when accessing freed memory pages

The validation uses the correct inline_size (from di->i_xattr_inline_size)
rather than block size, ensuring accurate bounds checking for inline
xattrs specifically.

Reported-by: syzbot+ab0ad25088673470d2d9@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ab0ad25088673470d2d9
Tested-by: syzbot+ab0ad25088673470d2d9@...kaller.appspotmail.com
Suggested-by: Heming Zhao <heming.zhao@...e.com>
Link: https://lore.kernel.org/all/20251111073831.2027072-1-kartikey406@gmail.com/ [v1]
Link: https://lore.kernel.org/all/20251117063217.5690-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
Changes in v3:
 - Moved validation from ocfs2_xattr_list_entries() to
   ocfs2_xattr_ibody_list() to use correct inline size calculation
   (suggested by Heming Zhao)
 - Added validation of i_xattr_inline_size before use
 - Added validation of xattr entry count against inline space
 - Changed return value to -EFSCORRUPTED for consistency
---
 fs/ocfs2/xattr.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index d70a20d29e3e..98fd4f3f2d2d 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -971,13 +971,39 @@ static int ocfs2_xattr_ibody_list(struct inode *inode,
 	struct ocfs2_xattr_header *header = NULL;
 	struct ocfs2_inode_info *oi = OCFS2_I(inode);
 	int ret = 0;
+	u16 xattr_count;
+	size_t max_entries;
+	u16 inline_size;
 
 	if (!(oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL))
 		return ret;
 
+	inline_size = le16_to_cpu(di->i_xattr_inline_size);
+
+	/* Validate inline size is reasonable */
+	if (inline_size > inode->i_sb->s_blocksize ||
+	    inline_size < sizeof(struct ocfs2_xattr_header)) {
+		ocfs2_error(inode->i_sb,
+			    "Invalid xattr inline size %u in inode %llu\n",
+			    inline_size,
+			    (unsigned long long)OCFS2_I(inode)->ip_blkno);
+		return -EFSCORRUPTED;
+	}
+
 	header = (struct ocfs2_xattr_header *)
-		 ((void *)di + inode->i_sb->s_blocksize -
-		 le16_to_cpu(di->i_xattr_inline_size));
+		 ((void *)di + inode->i_sb->s_blocksize - inline_size);
+
+	xattr_count = le16_to_cpu(header->xh_count);
+	max_entries = (inline_size - sizeof(struct ocfs2_xattr_header)) /
+		       sizeof(struct ocfs2_xattr_entry);
+
+	if (xattr_count > max_entries) {
+		ocfs2_error(inode->i_sb,
+			    "xattr entry count %u exceeds maximum %zu in inode %llu\n",
+			    xattr_count, max_entries,
+			    (unsigned long long)OCFS2_I(inode)->ip_blkno);
+		return -EFSCORRUPTED;
+	}
 
 	ret = ocfs2_xattr_list_entries(inode, header, buffer, buffer_size);
 
-- 
2.43.0