quota: Check next/prev free block number after reading from quota file
commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.
Following process:
Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
content in physical block (corresponding to blk 6) is random.
Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
dquot_release
remove_tree
free_dqentry
put_free_dqblk(6)
info->dqi_free_blk = blk // info->dqi_free_blk = 6
Step 3. drop cache (buffer head for block 6 is released)
Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
dh = (struct qt_disk_dqdbheader *)buf
blk = info->dqi_free_blk // 6
ret = read_blk(info, blk, buf) // The content of buf is random
info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
commit_dqblk -> v2_write_dquot -> dq_insert_tree:
do_insert_tree
find_free_dqentry
get_free_dqblk
blk = info->dqi_free_blk // If blk < 0 and blk is not an error
code, it will be returned as dquot
transfer_to[USRQUOTA] = dquot // A random negative value
__dquot_transfer(transfer_to)
dquot_add_inodes(transfer_to[cnt])
spin_lock(&dquot->dq_dqb_lock) // page fault
, which will lead to kernel page fault:
Quota error (device sda): qtree_write_dquot: Error -8000 occurred
while creating quota
BUG: unable to handle page fault for address: ffffffffffffe120
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP
CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:_raw_spin_lock+0x3a/0x90
Call Trace:
dquot_add_inodes+0x28/0x270
__dquot_transfer+0x377/0x840
dquot_transfer+0xde/0x540
ext4_setattr+0x405/0x14d0
notify_change+0x68e/0x9f0
chown_common+0x300/0x430
__x64_sys_fchownat+0x29/0x40
In order to avoid accessing invalid quota memory address, this patch adds
block number checking of next/prev free block read from quota file.
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
Fixes: 1da177e4c3
("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220923134555.2623931-2-chengzhihao1@huawei.com
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4cf9233eb1
commit
6927ee818f
@ -80,6 +80,35 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
|
||||
return ret;
|
||||
}
|
||||
|
||||
static inline int do_check_range(struct super_block *sb, const char *val_name,
|
||||
uint val, uint min_val, uint max_val)
|
||||
{
|
||||
if (val < min_val || val > max_val) {
|
||||
quota_error(sb, "Getting %s %u out of range %u-%u",
|
||||
val_name, val, min_val, max_val);
|
||||
return -EUCLEAN;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int check_dquot_block_header(struct qtree_mem_dqinfo *info,
|
||||
struct qt_disk_dqdbheader *dh)
|
||||
{
|
||||
int err = 0;
|
||||
|
||||
err = do_check_range(info->dqi_sb, "dqdh_next_free",
|
||||
le32_to_cpu(dh->dqdh_next_free), 0,
|
||||
info->dqi_blocks - 1);
|
||||
if (err)
|
||||
return err;
|
||||
err = do_check_range(info->dqi_sb, "dqdh_prev_free",
|
||||
le32_to_cpu(dh->dqdh_prev_free), 0,
|
||||
info->dqi_blocks - 1);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
/* Remove empty block from list and return it */
|
||||
static int get_free_dqblk(struct qtree_mem_dqinfo *info)
|
||||
{
|
||||
@ -94,6 +123,9 @@ static int get_free_dqblk(struct qtree_mem_dqinfo *info)
|
||||
ret = read_blk(info, blk, buf);
|
||||
if (ret < 0)
|
||||
goto out_buf;
|
||||
ret = check_dquot_block_header(info, dh);
|
||||
if (ret)
|
||||
goto out_buf;
|
||||
info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free);
|
||||
}
|
||||
else {
|
||||
@ -241,6 +273,9 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info,
|
||||
*err = read_blk(info, blk, buf);
|
||||
if (*err < 0)
|
||||
goto out_buf;
|
||||
*err = check_dquot_block_header(info, dh);
|
||||
if (*err)
|
||||
goto out_buf;
|
||||
} else {
|
||||
blk = get_free_dqblk(info);
|
||||
if ((int)blk < 0) {
|
||||
@ -433,6 +468,9 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot,
|
||||
goto out_buf;
|
||||
}
|
||||
dh = (struct qt_disk_dqdbheader *)buf;
|
||||
ret = check_dquot_block_header(info, dh);
|
||||
if (ret)
|
||||
goto out_buf;
|
||||
le16_add_cpu(&dh->dqdh_entries, -1);
|
||||
if (!le16_to_cpu(dh->dqdh_entries)) { /* Block got free? */
|
||||
ret = remove_free_dqentry(info, buf, blk);
|
||||
|
Loading…
Reference in New Issue
Block a user