From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 594FDC02192 for ; Wed, 5 Feb 2025 18:39:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D39D528000A; Wed, 5 Feb 2025 13:39:41 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CE9A4280004; Wed, 5 Feb 2025 13:39:41 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B8B6C28000A; Wed, 5 Feb 2025 13:39:41 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 981AA280004 for ; Wed, 5 Feb 2025 13:39:41 -0500 (EST) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 493951A034E for ; Wed, 5 Feb 2025 18:39:41 +0000 (UTC) X-FDA: 83086754562.25.E353859 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf15.hostedemail.com (Postfix) with ESMTP id 9410CA0011 for ; Wed, 5 Feb 2025 18:39:39 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=d5vsaVc2; spf=pass (imf15.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1738780779; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+Vr2LkbS8x6bzrMXz89/UuFQOuUNNuqN3wCFz3Dn6ls=; b=hqIgX+NzTXmZO0y5Zpq3XfEHr9eHb48+Mb3IbDcOyTlm5xrBiBxXgz5NG3F/AHhW/ohOCG O7U6LqkkoByT7VDeUv2w7wrqqAOPgsGhVojyp6YfvFzF8zP1xtK/IbWOloP67VCdGiJUVy T6b3yPmb3hj00EXfR2MKfT93/Ntwagc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1738780779; a=rsa-sha256; cv=none; b=gUxdtgCko8N8MmB8IPWXEZCPvu2GD7/fLjQPD0p1oChbIx26PkNe3MaET1nYouPSebkvIK 3WCGh+F9a9235Fgbk0S/h4ajS0XkkqcfniTO8EXgMY6cHoM0+RytfuxANSpTdkPFpoaLyn //m0Nxy1TEWfLm0MbZIFiKssGsgX70c= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=d5vsaVc2; spf=pass (imf15.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id A1DE95C6E27; Wed, 5 Feb 2025 18:38:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08129C4CEDD; Wed, 5 Feb 2025 18:39:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1738780778; bh=K2Dm4iFRSM/Ob4Zyy6ItdDl5CKpoNAwUnRnTz4l28l8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=d5vsaVc2+MQLeEBLEtrCNvUC26aT53lFfJAGYd5uiPWIpUlkru1JOcOqRDZ+HbkdN yjmlFavIzD06qZDtRMicoI05/5a3ucDsIgDyc2303EsqmhFIc4J61UINqigTmq87a3 70hkGNuhcmXg6QRvPzM9WqwsfyB/7k+XfW13zr53Uf8wOJKu+d0ePgY+8TlLHDSyRs aetzP19bINzGdfCAHDS3db6bx4Y42/c7WS1y9EL8j7vpZZ+gfqH18htEGb2EadKMy/ Rgsq+ejnIoOM2Ln3CP63tbrlwttDctTT+Im6xmJUdqHRWJLYTaoIdp8v+GnLBpAYnR eiC5ySU9OwXBQ== Date: Wed, 5 Feb 2025 10:39:37 -0800 From: Kees Cook To: Jan Kara Cc: syzbot , akpm@linux-foundation.org, brauner@kernel.org, gustavoars@kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mjguzik@gmail.com, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [hardening?] [mm?] BUG: bad usercopy in vfs_readlink Message-ID: <202502051031.2CF8D96392@keescook> References: <67a1e1f4.050a0220.163cdc.0063.GAE@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Stat-Signature: n9tmnu8wxbtio4onkb63jak6gf5bampa X-Rspamd-Queue-Id: 9410CA0011 X-Rspam-User: X-Rspamd-Server: rspam06 X-HE-Tag: 1738780779-658890 X-HE-Meta: U2FsdGVkX19hF14gP1q9HJT+m50M7EAfS290KHXZswjqWmzZy31p31lhD2KEbjsWxRzAz5BL1dya10v8ZI4Bb9SpnCDhLfeOZoXIc066bAqkOSJKQRkuLYeFcEB5Z0zpYnwsd+jpMXFonKGKB5JsLAcPaeJjNzEXYbMgW3y7ax32mcLF2pApbjof2Z8LAEIXCq15Sx8m/u/uEU3XTORbnXBpDs1bt71EB1rUXM4OusG1b5aaz2wt93LlpTdMeytfau4TvdC3LnovurwqiaZy1JAAejaayigPZUXamzcqeJq9xWSspR2bAZ0/fh/5nrZvsjK1Q79y2RZdPB7n31HA+VDR6bY4HR3mPPA5mPnG0G4DRtoEAr/UzM1reEpPPy7TXZdXYv0+SNWkdjSbksUW54WPoov5+DjficuP6hOhpG+F3dvap9/6iPXogOz/wDrozf7qG/oXLD3DABP5Na9+b9re6L/Bh1x78jvIuRCvLOmS97W5bMfeS9vg860otROjiKzWI0E0HKr6jV2lrHioeAQwKzWxCNbX4cVNuj1vY8M8bijBQsLLCeSVjpNFHROs8uCJgSda3OAQocdPe+H/DfMaswGIXd02gzG+19FYZJgdKCDRFZpcPkooiO2pHzTFEky8cdCVpvgeKF4jnZlhgGLtJNmrUr+cGOLhdGUwv1ejs59LpvH3AMzzYH/p41+ETeJafzBx7YnK1Iktu0QyOtg43QH2FSbBoMEYshvjcG/T0R6uRZgvTD8gCrWRn2I5ddZoyH5iqxvptIOExASG937GGvob1+xGFWGgcbpXJsirqIu9FIouwbXKx9ZDMt+FKi2TIHrLu3tq+O0RO6t9V5vYK+A69aRKtSGGKzxYdEHCYk7dqS3sd7VAH7mL0gXK20hK7Qr0/05+8kVy8vruxJjm5i3Wek1iMjBtOrpU3BCJIgrutImZqtobDBk/485dBr/E9/JHR03P7vKHwWL Mibln3rQ sX6bwLPT5oB3Jc6BSJvbpJ1EKk3SAViUn0HApje/2I/of1vUOYKVQjIisMsPX9jOsWv6CUnmUuCN1HPTGCui4rePFP8wgjGxLd2EiPmCiBSdVCgL2BzIOz/B12/vFWB8ASB14swPxTy8RqrcjCTg85PeJ3XayXycF+IASWuo7LXbhktQ95DVvo4fFGo6uuX+hjFE3GFQg2tH3FkdmySM0YaNTTCkMThsP/wUQKAS8OIZoyq2ENgJv0VBcL3GuijDMCwR+I1fYBQZ0Xw5Y/fxxK/YEJydcuAg82KzTSr/dDWjtsvYPAbhna+5VYIAgeiT6steNFCx+csNmVcTq0gm1RFNBK8oAL3XyGFJ8LNCRjIK1Ss4Z7t0tkSnxcfwX3xOYHt7SFZHGFsWnkaUpvXIlpcy/E0plU/ZAqsjKwC9xlH9J9ZEgyVdLYMKO/9fQQ62PNWOmLuwaNIXnjUiYsnB/Yf8ALcwujrn7zNheVhgSfstpAf68IeD1FSA+d8eeQIsKw1HpWd9k+7aVpR/emjS4jB8c4nD1xlFQKRC6B7fhX5U2H9+4G84auaVHly+2mAgnNb6wfkc1MgncD6oEhMjz3X+i7sd6UBNYDBmqBXFx28mIzP8BV+KoHaTDAsi9BhJMLCPS7Gc7nMPGKsI4Z3WseZpVou0NMF2covDjl2Pz7htNrA8Tx16qPS1kdYXhJy3plY9+kl68kF95wXsuf7JWavO0JXneUlxDi5pkr6JQ4Tgc9HAR4SaRn4gAkIHZMeQ5AgwdnMJrb8Ksz78kdBqEGGwWzx7dX7rhCNKJwOr3EANcLUhrGWQZexWo1L4hyhlR/kcj+cxnMpqoYcb2fKIRs90MCuz7WDfFJI8wTP4z8qDgtil5Yt1j2q1ltPGpRkhGGUhvYpsk986+NYRTUj4bOnZ/nf/pDm4XHpqjhINB9BxvKg5bpiDARbSML3VfzWi4hYrrZH52nKkNIJ41Lvo6vzzRbOFd YbZiHpAI IB2ceEcq0/cZmvUHK1wBRjlmsXRmdQrw X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Feb 05, 2025 at 07:21:04PM +0100, Jan Kara wrote: > On Tue 04-02-25 01:46:28, syzbot wrote: > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: 69b8923f5003 Merge tag 'for-linus-6.14-ofs4' of git://git... > > git tree: upstream > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1258aeb0580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=57ab43c279fa614d > > dashboard link: https://syzkaller.appspot.com/bug?extid=48a99e426f29859818c0 > > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15825724580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1658aeb0580000 > > > > Downloadable assets: > > disk image: https://storage.googleapis.com/syzbot-assets/ea84ac864e92/disk-69b8923f.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/6a465997b4e0/vmlinux-69b8923f.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/d72b67b2bd15/bzImage-69b8923f.xz > > mounted in repro: https://storage.googleapis.com/syzbot-assets/7c2919610764/mount_0.gz > > > > The issue was bisected to: > > > > commit bae80473f7b0b25772619e7692019b1549d4a82c > > Author: Mateusz Guzik > > Date: Wed Nov 20 11:20:35 2024 +0000 > > > > ext4: use inode_set_cached_link() > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1248c3df980000 > > final oops: https://syzkaller.appspot.com/x/report.txt?x=1148c3df980000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=1648c3df980000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+48a99e426f29859818c0@syzkaller.appspotmail.com > > Fixes: bae80473f7b0 ("ext4: use inode_set_cached_link()") > > Please check attached patch: > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master > > Honza > -- > Jan Kara > SUSE Labs, CR > From df00b84402fb67d94a9eb6b86633092983cb388c Mon Sep 17 00:00:00 2001 > From: Jan Kara > Date: Wed, 5 Feb 2025 19:02:35 +0100 > Subject: [PATCH] ext4: Verify fast symlink length > > Verify fast symlink length stored in inode->i_size matches the string > stored in the inode to avoid surprises from corrupted filesystems. > > Reported-by: syzbot+48a99e426f29859818c0@syzkaller.appspotmail.com > Fixes: bae80473f7b0 ("ext4: use inode_set_cached_link()") > Suggested-by: "Darrick J. Wong" > Signed-off-by: Jan Kara > --- > fs/ext4/inode.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c > index 7c54ae5fcbd4..fbda5a67f7f9 100644 > --- a/fs/ext4/inode.c > +++ b/fs/ext4/inode.c > @@ -5007,8 +5007,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, > inode->i_op = &ext4_encrypted_symlink_inode_operations; > } else if (ext4_inode_is_fast_symlink(inode)) { > inode->i_op = &ext4_fast_symlink_inode_operations; > - nd_terminate_link(ei->i_data, inode->i_size, > - sizeof(ei->i_data) - 1); > + if (inode->i_size == 0 || > + inode->i_size >= EXT4_N_BLOCKS * 4 || This took me a while to understand. ei->i_data is u32[15]. It looks like EXT4_N_BLOCKS is also 15. I feel like it would be much more readable to have the above check be: inode->i_size >= sizeof(ei->i_data) || instead of using a literal "4" for sizeof(u32) as "4", and having a EXT4_N_BLOCKS standing in for the literal "15" in i_data. sizeof(ei->i_data) is precisely what is being checked, so why not use it? And while at it, the definition of i_data could be adjusted to to use EXT4_N_BLOCKS, e.g.: struct ext4_inode_info { __le32 i_data[EXT4_N_BLOCKS]; /* unconverted */ ? > + strnlen((char *)ei->i_data, inode->i_size + 1) != > + inode->i_size) { > + ext4_error_inode(inode, function, line, 0, > + "invalid fast symlink length %llu", > + (unsigned long long)inode->i_size); > + ret = -EFSCORRUPTED; > + goto bad_inode; > + } But regardless, yes, the math checks out, and looks correct to me. > inode_set_cached_link(inode, (char *)ei->i_data, > inode->i_size); > } else { > -- > 2.43.0 > -Kees -- Kees Cook