ext4: add more paranoia checking in ext4_expand_extra_isize handling

commit 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a upstream.

It's possible to specify a non-zero s_want_extra_isize via debugging
option, and this can cause bad things(tm) to happen when using a file
system with an inode size of 128 bytes.

Add better checking when the file system is mounted, as well as when
we are actually doing the trying to do the inode expansion.

Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu
Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com
Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com
Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 00c320e2ba1eed5bae6f35691d2aad28646711e6..8133e6529994793f7a8d50a2f3bc480affd001eb 100644 (file)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5472,10 +5472,25 @@ static int ext4_expand_extra_isize(struct inode *inode,
 {
        struct ext4_inode *raw_inode;
        struct ext4_xattr_ibody_header *header;
+       unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);
+       struct ext4_inode_info *ei = EXT4_I(inode);
 
        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
                return 0;
 
+       /* this was checked at iget time, but double check for good measure */
+       if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||
+           (ei->i_extra_isize & 3)) {
+               EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",
+                                ei->i_extra_isize,
+                                EXT4_INODE_SIZE(inode->i_sb));
+               return -EFSCORRUPTED;
+       }
+       if ((new_extra_isize < ei->i_extra_isize) ||
+           (new_extra_isize < 4) ||
+           (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))
+               return -EINVAL; /* Should never happen */
+
        raw_inode = ext4_raw_inode(&iloc);
 
        header = IHDR(inode, raw_inode);

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cea813adbe12fa815a2d04309e44c740f7e70b0f..391ab55808c920c01359e0265dc7bef3d29c1fd6 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3346,11 +3346,15 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        struct ext4_super_block *es = sbi->s_es;
+       unsigned def_extra_isize = sizeof(struct ext4_inode) -
+                                               EXT4_GOOD_OLD_INODE_SIZE;
 
-       /* determine the minimum size of new large inodes, if present */
-       if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) {
-               sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
-                                                    EXT4_GOOD_OLD_INODE_SIZE;
+       if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {
+               sbi->s_want_extra_isize = 0;
+               return;
+       }
+       if (sbi->s_want_extra_isize < 4) {
+               sbi->s_want_extra_isize = def_extra_isize;
                if (ext4_has_feature_extra_isize(sb)) {
                        if (sbi->s_want_extra_isize <
                            le16_to_cpu(es->s_want_extra_isize))
@@ -3363,10 +3367,10 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb)
                }
        }
        /* Check if enough inode space is available */
-       if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
-                                                       sbi->s_inode_size) {
-               sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
-                                                      EXT4_GOOD_OLD_INODE_SIZE;
+       if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||
+           (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+                                                       sbi->s_inode_size)) {
+               sbi->s_want_extra_isize = def_extra_isize;
                ext4_msg(sb, KERN_INFO,
                         "required extra inode space not available");
        }