Corrupted inode may contain invalid i_inline_xattr_size field, when F2FS_FEATURE_FLEXIBLE_INLINE_XATTR is enabled, and inode has not F2FS_INLINE_XATTR flag, fsck.f2fs won't check its validation, however we will still use i_inline_xattr_size field via get_inline_xattr_addrs(), it may cause potential heap buffer underflows and out-of-bound read/write.
In addition, we missed to check i_inline_xattr_size w/ lower boundary MIN_INLINE_XATTR_SIZE like we did in kernel side. This patch fixes above two issues. Signed-off-by: Chao Yu <[email protected]> --- fsck/fsck.c | 10 ++++++---- fsck/xattr.h | 2 ++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/fsck/fsck.c b/fsck/fsck.c index 4fca4dd..e679357 100644 --- a/fsck/fsck.c +++ b/fsck/fsck.c @@ -1063,14 +1063,16 @@ check_next: } } - if ((c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) && - (node_blk->i.i_inline & F2FS_INLINE_XATTR)) { + if (c.feature & F2FS_FEATURE_FLEXIBLE_INLINE_XATTR) { unsigned int inline_size = le16_to_cpu(node_blk->i.i_inline_xattr_size); if (time_to_inject(FAULT_INODE) || - (!inline_size || - inline_size > MAX_INLINE_XATTR_SIZE)) { + inline_size > MAX_INLINE_XATTR_SIZE || + (inline_size != 0 && + inline_size < MIN_INLINE_XATTR_SIZE) || + ((node_blk->i.i_inline & F2FS_INLINE_XATTR) && + !inline_size)) { ASSERT_MSG("[0x%x] wrong inline_xattr_size:%u", nid, inline_size); if (c.fix_on) { diff --git a/fsck/xattr.h b/fsck/xattr.h index 867349c..5f59e8e 100644 --- a/fsck/xattr.h +++ b/fsck/xattr.h @@ -200,4 +200,6 @@ static inline int f2fs_acl_count(int size) F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) - \ DEF_INLINE_RESERVED_SIZE - \ MIN_INLINE_DENTRY_SIZE / sizeof(__le32)) +#define MIN_INLINE_XATTR_SIZE \ + (sizeof(struct f2fs_xattr_header) / sizeof(__le32)) #endif -- 2.49.0 _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
