From: lei lu llfamsec@gmail.com
[ Upstream commit fb63435b7c7dc112b1ae1baea5486e0a6e27b196 ]
There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data.
We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc
Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header.
Signed-off-by: lei lu llfamsec@gmail.com Reviewed-by: Dave Chinner dchinner@redhat.com Reviewed-by: Darrick J. Wong djwong@kernel.org Signed-off-by: Chandan Babu R chandanbabu@kernel.org Signed-off-by: Bin Lan bin.lan.cn@windriver.com --- fs/xfs/xfs_log_recover.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c index affe94356ed1..006a376c34b2 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -2439,7 +2439,10 @@ xlog_recover_process_data(
ohead = (struct xlog_op_header *)dp; dp += sizeof(*ohead); - ASSERT(dp <= end); + if (dp > end) { + xfs_warn(log->l_mp, "%s: op header overrun", __func__); + return -EFSCORRUPTED; + }
/* errors will abort recovery */ error = xlog_recover_process_ophdr(log, rhash, rhead, ohead,
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: fb63435b7c7dc112b1ae1baea5486e0a6e27b196
WARNING: Author mismatch between patch and upstream commit: Backport author: Bin Lan bin.lan.cn@windriver.com Commit author: lei lu llfamsec@gmail.com
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.11.y | Present (exact SHA1) 6.6.y | Not found 6.1.y | Not found
Note: The patch differs from the upstream commit: --- --- - 2024-11-27 09:15:10.118544781 -0500 +++ /tmp/tmp.yXhwFlxu6p 2024-11-27 09:15:10.108180884 -0500 @@ -1,3 +1,5 @@ +[ Upstream commit fb63435b7c7dc112b1ae1baea5486e0a6e27b196 ] + There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data.
@@ -22,15 +24,16 @@ Reviewed-by: Dave Chinner dchinner@redhat.com Reviewed-by: Darrick J. Wong djwong@kernel.org Signed-off-by: Chandan Babu R chandanbabu@kernel.org +Signed-off-by: Bin Lan bin.lan.cn@windriver.com --- fs/xfs/xfs_log_recover.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c -index 4fe627991e865..409b645ce7995 100644 +index affe94356ed1..006a376c34b2 100644 --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c -@@ -2489,7 +2489,10 @@ xlog_recover_process_data( +@@ -2439,7 +2439,10 @@ xlog_recover_process_data(
ohead = (struct xlog_op_header *)dp; dp += sizeof(*ohead); @@ -42,3 +45,6 @@
/* errors will abort recovery */ error = xlog_recover_process_ophdr(log, rhash, rhead, ohead, +-- +2.34.1 + ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |
linux-stable-mirror@lists.linaro.org