commit 9ed50b8231e37b1ae863f5dec8153b98d9f389b4 upstream.

Fast symlink can be used if the on-disk symlink data is stored
in the same block as the on-disk inode, so we don’t need to trigger
another I/O for symlink data.  However, currently fs correction could be
reported _incorrectly_ if inode xattrs are too large.

In fact, these should be valid images although they cannot be handled as
fast symlinks.

Many thanks to Colin for reporting this!

Reported-by: Colin Walters <walt...@verbum.org>
Reported-by: https://honggfuzz.dev/
Link: 
https://lore.kernel.org/r/bb2dd430-7de0-47da-ae5b-82ab2dd4d...@app.fastmail.com
Fixes: 431339ba9042 ("staging: erofs: add inode operations")
[ Note that it's a runtime misbehavior instead of a security issue. ]
Link: 
https://lore.kernel.org/r/20240909031911.1174718-1-hsiang...@linux.alibaba.com
Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com>
---
 fs/erofs/inode.c | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
index 638bb70d0d65..c68258ae70d3 100644
--- a/fs/erofs/inode.c
+++ b/fs/erofs/inode.c
@@ -219,11 +219,14 @@ static int erofs_fill_symlink(struct inode *inode, void 
*data,
                              unsigned int m_pofs)
 {
        struct erofs_inode *vi = EROFS_I(inode);
+       loff_t off;
        char *lnk;
 
-       /* if it cannot be handled with fast symlink scheme */
-       if (vi->datalayout != EROFS_INODE_FLAT_INLINE ||
-           inode->i_size >= PAGE_SIZE || inode->i_size < 0) {
+       m_pofs += vi->xattr_isize;
+       /* check if it cannot be handled with fast symlink scheme */
+       if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||
+           check_add_overflow(m_pofs, inode->i_size, &off) ||
+           off > i_blocksize(inode)) {
                inode->i_op = &erofs_symlink_iops;
                return 0;
        }
@@ -232,17 +235,6 @@ static int erofs_fill_symlink(struct inode *inode, void 
*data,
        if (!lnk)
                return -ENOMEM;
 
-       m_pofs += vi->xattr_isize;
-       /* inline symlink data shouldn't cross page boundary as well */
-       if (m_pofs + inode->i_size > PAGE_SIZE) {
-               kfree(lnk);
-               erofs_err(inode->i_sb,
-                         "inline data cross block boundary @ nid %llu",
-                         vi->nid);
-               DBG_BUGON(1);
-               return -EFSCORRUPTED;
-       }
-
        memcpy(lnk, data + m_pofs, inode->i_size);
        lnk[inode->i_size] = '\0';
 
-- 
2.43.5

Reply via email to