Eric Biggers 504cf969d5 fs-verity: fix signed integer overflow with i_size near S64_MAX ... commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream. If the file size is almost S64_MAX, the calculated number of Merkle tree levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to fail. This is unintentional, since as the comment above the definition of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.) The bug is actually that when the number of blocks in the first level is calculated from i_size, there is a signed integer overflow due to i_size being signed. Fix this by treating i_size as unsigned. This was found by the new test "generic: test fs-verity EFBIG scenarios" (https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io). This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to S64_MAX bytes. Reported-by: Boris Burkov <boris@bur.io> Fixes: 3fda4c617e ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl") Fixes: fd2d1acfca ("fs-verity: add the hook for file ->open()") Cc: <stable@vger.kernel.org> # v5.4+ Reviewed-by: Boris Burkov <boris@bur.io> Link: https://lore.kernel.org/r/20210916203424.113376-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-10-06 15:42:30 +02:00
..
9p
adfs
affs	fs/affs: release old buffer head on error path	2021-03-04 10:26:48 +01:00
afs	afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation	2021-09-30 10:09:22 +02:00
autofs
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:48:39 +01:00
btrfs	btrfs: prevent __btrfs_dump_space_info() to underflow its free space	2021-09-30 10:09:22 +02:00
cachefiles
ceph	ceph: lockdep annotations for try_nonblocking_invalidate	2021-09-26 14:07:11 +02:00
cifs	cifs: fix a sign extension bug	2021-09-30 10:09:24 +02:00
coda
configfs	configfs: fix memleak in configfs_release_bin_file	2021-07-14 16:53:46 +02:00
cramfs
crypto	fscrypt: add fscrypt_symlink_getattr() for computing st_size	2021-09-12 08:56:38 +02:00
debugfs	debugfs: Return error during {full/open}_proxy_open() on rmmod	2021-09-15 09:47:33 +02:00
devpts
dlm	fs: dlm: fix memory leak when fenced	2021-07-14 16:53:17 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:05:19 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:49:53 +01:00
efs
erofs	erofs: add unsupported inode i_format check	2021-05-11 14:04:02 +02:00
exportfs
ext2
ext4	ext4: report correct st_size for encrypted symlinks	2021-09-12 08:56:38 +02:00
f2fs	f2fs: fix to unmap pages from userspace process in punch_hole()	2021-09-22 12:26:26 +02:00
fat
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-22 12:26:25 +02:00
fuse	fuse: fix use after free in fuse_read_interrupt()	2021-09-22 12:26:43 +02:00
gfs2	gfs2: Don't call dlm after protocol is unmounted	2021-09-22 12:26:33 +02:00
hfs	hfs: add lock nesting notation to hfs_find_init	2021-07-31 08:19:38 +02:00
hfsplus	hfsplus: prevent corruption in shrinking truncate	2021-05-19 10:08:29 +02:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs	hugetlbfs: fix mount mode command line processing	2021-07-28 13:31:01 +02:00
iomap	mm/swap: consider max pages in iomap_swapfile_add_extent	2021-09-15 09:47:35 +02:00
isofs	isofs: joliet: Fix iocharset=utf8 mount option	2021-09-15 09:47:27 +02:00
jbd2
jffs2	jffs2: check the validity of dstlen in jffs2_zlib_compress()	2021-05-11 14:04:16 +02:00
jfs	fs/jfs: Fix missing error code in lmLogInit()	2021-07-20 16:10:42 +02:00
kernfs
lockd	lockd: lockd server-side shouldn't set fl_ops	2021-09-22 12:26:34 +02:00
minix
nfs	NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times	2021-07-20 16:10:50 +02:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:51:22 +01:00
nfsd	nfsd4: Fix forced-expiry locking	2021-09-15 09:47:35 +02:00
nilfs2	nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group	2021-09-26 14:07:13 +02:00
nls
notify
ntfs	ntfs: fix validity check for file name attribute	2021-07-14 16:53:01 +02:00
ocfs2	ocfs2: drop acl cache for directories too	2021-09-30 10:09:20 +02:00
omfs
openpromfs
orangefs	orangefs: fix orangefs df output.	2021-07-20 16:10:48 +02:00
overlayfs	ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()	2021-09-22 12:26:37 +02:00
proc	mm, oom: make the calculation of oom badness more accurate	2021-09-03 10:08:12 +02:00
pstore	pstore: Fix typo in compression option name	2021-03-04 10:26:45 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:09:26 +02:00
qnx6
quota	quota: Fix memory leak when handling corrupted quota file	2021-03-04 10:26:26 +01:00
ramfs
reiserfs	reiserfs: check directory items on read from disk	2021-08-12 13:21:05 +02:00
romfs
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:08:29 +02:00
sysfs	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output	2021-03-07 12:20:48 +01:00
sysv
tracefs
ubifs	ubifs: report correct st_size for encrypted symlinks	2021-09-12 08:56:39 +02:00
udf	udf_get_extendedattr() had no boundary checks.	2021-09-15 09:47:28 +02:00
ufs
unicode
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-10-06 15:42:30 +02:00
xfs	xfs: Fix assert failure in xfs_setattr_size()	2021-03-07 12:20:42 +01:00
aio.c
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:03:57 +01:00
binfmt_script.c
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 11:38:29 +02:00
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c	coredump: fix core_pattern parse error	2020-12-11 13:23:30 +01:00
d_path.c
dax.c	dax: fix ENOMEM handling in grab_mapping_entry()	2021-07-14 16:53:25 +02:00
dcache.c
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:24:11 +02:00
drop_caches.c
eventfd.c
eventpoll.c
exec.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:44:55 +01:00
fcntl.c	fcntl: fix potential deadlock for &fasync_struct.fa_lock	2021-09-15 09:47:28 +02:00
fhandle.c
file_table.c
file.c
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	writeback: fix obtain a reference to a freeing memcg css	2021-07-14 16:53:35 +02:00
fsopen.c
inode.c
internal.h	cgroup1: fix leaked context root causing sporadic NULL deref in LTP	2021-07-31 08:19:37 +02:00
io_uring.c	io_uring: Fix current->fs handling in io_sq_wq_submit_work()	2021-01-30 13:54:10 +01:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-24 13:29:19 +01:00
locks.c
Makefile
mbcache.c
mount.h
mpage.c
namei.c
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:36:22 -04:00
no-block.c
nsfs.c
open.c
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-12 13:21:02 +02:00
pnode.c
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:03:33 +01:00
posix_acl.c
proc_namespace.c
read_write.c
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 12:56:16 +02:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-24 11:26:44 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:10:54 +02:00
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c	vfs: remove lockdep bogosity in __sb_start_write	2020-11-24 13:29:01 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: prevent concurrent API initialization	2021-09-22 12:26:26 +02:00
utimes.c
xattr.c