lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 058/210] quota: Check next/prev free block number after reading from quota file
    Date
    From: Zhihao Cheng <chengzhihao1@huawei.com>

    commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.

    Following process:
    Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6

    Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
    qtree_write_dquot
    do_insert_tree
    find_free_dqentry
    get_free_dqblk
    write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
    content in physical block (corresponding to blk 6) is random.

    Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
    ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
    dquot_release
    remove_tree
    free_dqentry
    put_free_dqblk(6)
    info->dqi_free_blk = blk // info->dqi_free_blk = 6

    Step 3. drop cache (buffer head for block 6 is released)

    Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
    qtree_write_dquot
    do_insert_tree
    find_free_dqentry
    get_free_dqblk
    dh = (struct qt_disk_dqdbheader *)buf
    blk = info->dqi_free_blk // 6
    ret = read_blk(info, blk, buf) // The content of buf is random
    info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk

    Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
    dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
    commit_dqblk -> v2_write_dquot -> dq_insert_tree:
    do_insert_tree
    find_free_dqentry
    get_free_dqblk
    blk = info->dqi_free_blk // If blk < 0 and blk is not an error
    code, it will be returned as dquot

    transfer_to[USRQUOTA] = dquot // A random negative value
    __dquot_transfer(transfer_to)
    dquot_add_inodes(transfer_to[cnt])
    spin_lock(&dquot->dq_dqb_lock) // page fault

    , which will lead to kernel page fault:
    Quota error (device sda): qtree_write_dquot: Error -8000 occurred
    while creating quota
    BUG: unable to handle page fault for address: ffffffffffffe120
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0002) - not-present page
    Oops: 0002 [#1] PREEMPT SMP
    CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
    RIP: 0010:_raw_spin_lock+0x3a/0x90
    Call Trace:
    dquot_add_inodes+0x28/0x270
    __dquot_transfer+0x377/0x840
    dquot_transfer+0xde/0x540
    ext4_setattr+0x405/0x14d0
    notify_change+0x68e/0x9f0
    chown_common+0x300/0x430
    __x64_sys_fchownat+0x29/0x40

    In order to avoid accessing invalid quota memory address, this patch adds
    block number checking of next/prev free block read from quota file.

    Fetch a reproducer in [Link].

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
    Fixes: 1da177e4c3f4152 ("Linux-2.6.12-rc2")
    CC: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20220923134555.2623931-2-chengzhihao1@huawei.com
    Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/quota/quota_tree.c | 38 ++++++++++++++++++++++++++++++++++++++
    1 file changed, 38 insertions(+)

    --- a/fs/quota/quota_tree.c
    +++ b/fs/quota/quota_tree.c
    @@ -79,6 +79,35 @@ static ssize_t write_blk(struct qtree_me
    return ret;
    }

    +static inline int do_check_range(struct super_block *sb, const char *val_name,
    + uint val, uint min_val, uint max_val)
    +{
    + if (val < min_val || val > max_val) {
    + quota_error(sb, "Getting %s %u out of range %u-%u",
    + val_name, val, min_val, max_val);
    + return -EUCLEAN;
    + }
    +
    + return 0;
    +}
    +
    +static int check_dquot_block_header(struct qtree_mem_dqinfo *info,
    + struct qt_disk_dqdbheader *dh)
    +{
    + int err = 0;
    +
    + err = do_check_range(info->dqi_sb, "dqdh_next_free",
    + le32_to_cpu(dh->dqdh_next_free), 0,
    + info->dqi_blocks - 1);
    + if (err)
    + return err;
    + err = do_check_range(info->dqi_sb, "dqdh_prev_free",
    + le32_to_cpu(dh->dqdh_prev_free), 0,
    + info->dqi_blocks - 1);
    +
    + return err;
    +}
    +
    /* Remove empty block from list and return it */
    static int get_free_dqblk(struct qtree_mem_dqinfo *info)
    {
    @@ -93,6 +122,9 @@ static int get_free_dqblk(struct qtree_m
    ret = read_blk(info, blk, buf);
    if (ret < 0)
    goto out_buf;
    + ret = check_dquot_block_header(info, dh);
    + if (ret)
    + goto out_buf;
    info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free);
    }
    else {
    @@ -240,6 +272,9 @@ static uint find_free_dqentry(struct qtr
    *err = read_blk(info, blk, buf);
    if (*err < 0)
    goto out_buf;
    + *err = check_dquot_block_header(info, dh);
    + if (*err)
    + goto out_buf;
    } else {
    blk = get_free_dqblk(info);
    if ((int)blk < 0) {
    @@ -432,6 +467,9 @@ static int free_dqentry(struct qtree_mem
    goto out_buf;
    }
    dh = (struct qt_disk_dqdbheader *)buf;
    + ret = check_dquot_block_header(info, dh);
    + if (ret)
    + goto out_buf;
    le16_add_cpu(&dh->dqdh_entries, -1);
    if (!le16_to_cpu(dh->dqdh_entries)) { /* Block got free? */
    ret = remove_free_dqentry(info, buf, blk);

    \
     
     \ /
      Last update: 2022-10-24 14:02    [W:4.185 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site