f65c4bbbd6
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
sanity checking of the xattr_ids count in the filesystem. Both of these
flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which
stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The
variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
type of the sizeof operator is "unsigned long".
On a 64-bit system this is 64-bits in size, and causes the negative number
to be sign extended and widened to 64-bits and then become unsigned. This
produces the very large number 18446744073709548016 or 2^64 - 3600. This
number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and
divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0
(stored in len).
Flaw 2 (32-bit systems only):
On a 32-bit system the integer variable is not widened by the unsigned
long type of the sizeof operator (32-bits), and the signedness of the
variable has no effect due it always being treated as unsigned.
The above corrupted xattr_ids value of 4294967071, when multiplied
overflows and produces the number 4294963696 or 2^32 - 3400. This number
when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by
SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.
The effect of the 0 length computation:
In conjunction with the corrupted xattr_ids field, the filesystem also has
a corrupted xattr_table_start value, where it matches the end of
filesystem value of 850.
This causes the following sanity check code to fail because the
incorrectly computed len of 0 matches the incorrect size of the table
reported by the superblock (0 bytes).
len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
/*
* The computed size of the index table (len bytes) should exactly
* match the table start and end points
*/
start = table_start + sizeof(*id_table);
end = msblk->bytes_used;
if (len != (end - start))
return ERR_PTR(-EINVAL);
Changing the xattr_ids variable to be "usigned int" fixes the flaw on a
64-bit system. This relies on the fact the computation is widened by the
unsigned long type of the sizeof operator.
Casting the variable to u64 in the above macro fixes this flaw on a 32-bit
system.
It also means 64-bit systems do not implicitly rely on the type of the
sizeof operator to widen the computation.
[1] https://lore.kernel.org/lkml/000000000000cd44f005f1a0f17f@google.com/
Link: https://lkml.kernel.org/r/20230127061842.10965-1-phillip@squashfs.org.uk
Fixes: 506220d2ba ("squashfs: add more sanity checks in xattr id lookup")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Fedor Pchelkin <pchelkin@ispras.ru>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
73 lines
1.6 KiB
C
73 lines
1.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
#ifndef SQUASHFS_FS_SB
|
|
#define SQUASHFS_FS_SB
|
|
/*
|
|
* Squashfs
|
|
*
|
|
* Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* squashfs_fs_sb.h
|
|
*/
|
|
|
|
#include "squashfs_fs.h"
|
|
|
|
struct squashfs_cache {
|
|
char *name;
|
|
int entries;
|
|
int curr_blk;
|
|
int next_blk;
|
|
int num_waiters;
|
|
int unused;
|
|
int block_size;
|
|
int pages;
|
|
spinlock_t lock;
|
|
wait_queue_head_t wait_queue;
|
|
struct squashfs_cache_entry *entry;
|
|
};
|
|
|
|
struct squashfs_cache_entry {
|
|
u64 block;
|
|
int length;
|
|
int refcount;
|
|
u64 next_index;
|
|
int pending;
|
|
int error;
|
|
int num_waiters;
|
|
wait_queue_head_t wait_queue;
|
|
struct squashfs_cache *cache;
|
|
void **data;
|
|
struct squashfs_page_actor *actor;
|
|
};
|
|
|
|
struct squashfs_sb_info {
|
|
const struct squashfs_decompressor *decompressor;
|
|
int devblksize;
|
|
int devblksize_log2;
|
|
struct squashfs_cache *block_cache;
|
|
struct squashfs_cache *fragment_cache;
|
|
struct squashfs_cache *read_page;
|
|
int next_meta_index;
|
|
__le64 *id_table;
|
|
__le64 *fragment_index;
|
|
__le64 *xattr_id_table;
|
|
struct mutex meta_index_mutex;
|
|
struct meta_index *meta_index;
|
|
void *stream;
|
|
__le64 *inode_lookup_table;
|
|
u64 inode_table;
|
|
u64 directory_table;
|
|
u64 xattr_table;
|
|
unsigned int block_size;
|
|
unsigned short block_log;
|
|
long long bytes_used;
|
|
unsigned int inodes;
|
|
unsigned int fragments;
|
|
unsigned int xattr_ids;
|
|
unsigned int ids;
|
|
bool panic_on_errors;
|
|
const struct squashfs_decompressor_thread_ops *thread_ops;
|
|
int max_thread_num;
|
|
};
|
|
#endif
|