MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-06 17:35:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

erofs: fix incorrect symlink detection in fast symlink

Browse Source 
[ Upstream commit 9ed50b8231 ]

Fast symlink can be used if the on-disk symlink data is stored
in the same block as the on-disk inode, so we don’t need to trigger
another I/O for symlink data.  However, currently fs correction could be
reported _incorrectly_ if inode xattrs are too large.

In fact, these should be valid images although they cannot be handled as
fast symlinks.

Many thanks to Colin for reporting this!

Reported-by: Colin Walters <walters@verbum.org>
Reported-by: https://honggfuzz.dev/
Link: https://lore.kernel.org/r/bb2dd430-7de0-47da-ae5b-82ab2dd4d945@app.fastmail.com
Fixes: 431339ba90 ("staging: erofs: add inode operations")
[ Note that it's a runtime misbehavior instead of a security issue. ]
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240909031911.1174718-1-hsiangkao@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Gao Xiang 2024-09-09 11:19:11 +08:00 committed by Greg Kroah-Hartman
parent 81b048b948
commit 0c9b52bfee
1 changed files with 6 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fs/erofs/inode.c
View File

@ -205,12 +205,14 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr,
unsigned int m_pofs) unsigned int m_pofs)
{ {
struct erofs_inode *vi = EROFS_I(inode); struct erofs_inode *vi = EROFS_I(inode);
unsigned int bsz = i_blocksize(inode); loff_t off;
char *lnk; char *lnk;
/* if it cannot be handled with fast symlink scheme */ m_pofs += vi->xattr_isize;
if (vi->datalayout != EROFS_INODE_FLAT_INLINE || /* check if it cannot be handled with fast symlink scheme */
inode->i_size >= bsz || inode->i_size < 0) { if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||
check_add_overflow(m_pofs, inode->i_size, &off) ||
off > i_blocksize(inode)) {
inode->i_op = &erofs_symlink_iops; inode->i_op = &erofs_symlink_iops;
return 0; return 0;
} }
@ -219,16 +221,6 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr,
if (!lnk) if (!lnk)
return -ENOMEM; return -ENOMEM;
m_pofs += vi->xattr_isize;
/* inline symlink data shouldn't cross block boundary */
if (m_pofs + inode->i_size > bsz) {
kfree(lnk);
erofs_err(inode->i_sb,
"inline data cross block boundary @ nid %llu",
vi->nid);
DBG_BUGON(1);
return -EFSCORRUPTED;
}
memcpy(lnk, kaddr + m_pofs, inode->i_size); memcpy(lnk, kaddr + m_pofs, inode->i_size);
lnk[inode->i_size] = '\0'; lnk[inode->i_size] = '\0';