1c13c9c40e
[ Upstream commit aa53e3bfac7205fb3a8815ac1c937fd6ed01b41e ] Nikolay reported the following KASAN splat when running btrfs/048: [ 1843.470920] ================================================================== [ 1843.471971] BUG: KASAN: slab-out-of-bounds in strncmp+0x66/0xb0 [ 1843.472775] Read of size 1 at addr ffff888111e369e2 by task btrfs/3979 [ 1843.473904] CPU: 3 PID: 3979 Comm: btrfs Not tainted 5.2.0-rc3-default #536 [ 1843.475009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 1843.476322] Call Trace: [ 1843.476674] dump_stack+0x7c/0xbb [ 1843.477132] ? strncmp+0x66/0xb0 [ 1843.477587] print_address_description+0x114/0x320 [ 1843.478256] ? strncmp+0x66/0xb0 [ 1843.478740] ? strncmp+0x66/0xb0 [ 1843.479185] __kasan_report+0x14e/0x192 [ 1843.479759] ? strncmp+0x66/0xb0 [ 1843.480209] kasan_report+0xe/0x20 [ 1843.480679] strncmp+0x66/0xb0 [ 1843.481105] prop_compression_validate+0x24/0x70 [ 1843.481798] btrfs_xattr_handler_set_prop+0x65/0x160 [ 1843.482509] __vfs_setxattr+0x71/0x90 [ 1843.483012] __vfs_setxattr_noperm+0x84/0x130 [ 1843.483606] vfs_setxattr+0xac/0xb0 [ 1843.484085] setxattr+0x18c/0x230 [ 1843.484546] ? vfs_setxattr+0xb0/0xb0 [ 1843.485048] ? __mod_node_page_state+0x1f/0xa0 [ 1843.485672] ? _raw_spin_unlock+0x24/0x40 [ 1843.486233] ? __handle_mm_fault+0x988/0x1290 [ 1843.486823] ? lock_acquire+0xb4/0x1e0 [ 1843.487330] ? lock_acquire+0xb4/0x1e0 [ 1843.487842] ? mnt_want_write_file+0x3c/0x80 [ 1843.488442] ? debug_lockdep_rcu_enabled+0x22/0x40 [ 1843.489089] ? rcu_sync_lockdep_assert+0xe/0x70 [ 1843.489707] ? __sb_start_write+0x158/0x200 [ 1843.490278] ? mnt_want_write_file+0x3c/0x80 [ 1843.490855] ? __mnt_want_write+0x98/0xe0 [ 1843.491397] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.492201] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1843.493201] do_syscall_64+0x6c/0x230 [ 1843.493988] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1843.495041] RIP: 0033:0x7fa7a8a7707a [ 1843.495819] Code: 48 8b 0d 21 de 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ee dd 2b 00 f7 d8 64 89 01 48 [ 1843.499203] RSP: 002b:00007ffcb73bca38 EFLAGS: 00000202 ORIG_RAX: 00000000000000be [ 1843.500210] RAX: ffffffffffffffda RBX: 00007ffcb73bda9d RCX: 00007fa7a8a7707a [ 1843.501170] RDX: 00007ffcb73bda9d RSI: 00000000006dc050 RDI: 0000000000000003 [ 1843.502152] RBP: 00000000006dc050 R08: 0000000000000000 R09: 0000000000000000 [ 1843.503109] R10: 0000000000000002 R11: 0000000000000202 R12: 00007ffcb73bda91 [ 1843.504055] R13: 0000000000000003 R14: 00007ffcb73bda82 R15: ffffffffffffffff [ 1843.505268] Allocated by task 3979: [ 1843.505771] save_stack+0x19/0x80 [ 1843.506211] __kasan_kmalloc.constprop.5+0xa0/0xd0 [ 1843.506836] setxattr+0xeb/0x230 [ 1843.507264] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.507886] do_syscall_64+0x6c/0x230 [ 1843.508429] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1843.509558] Freed by task 0: [ 1843.510188] (stack is not available) [ 1843.511309] The buggy address belongs to the object at ffff888111e369e0 which belongs to the cache kmalloc-8 of size 8 [ 1843.514095] The buggy address is located 2 bytes inside of 8-byte region [ffff888111e369e0, ffff888111e369e8) [ 1843.516524] The buggy address belongs to the page: [ 1843.517561] page:ffff88813f478d80 refcount:1 mapcount:0 mapping:ffff88811940c300 index:0xffff888111e373b8 compound_mapcount: 0 [ 1843.519993] flags: 0x4404000010200(slab|head) [ 1843.520951] raw: 0004404000010200 ffff88813f48b008 ffff888119403d50 ffff88811940c300 [ 1843.522616] raw: ffff888111e373b8 000000000016000f 00000001ffffffff 0000000000000000 [ 1843.524281] page dumped because: kasan: bad access detected [ 1843.525936] Memory state around the buggy address: [ 1843.526975] ffff888111e36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.528479] ffff888111e36900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.530138] >ffff888111e36980: fc fc fc fc fc fc fc fc fc fc fc fc 02 fc fc fc [ 1843.531877] ^ [ 1843.533287] ffff888111e36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.534874] ffff888111e36a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.536468] ================================================================== This is caused by supplying a too short compression value ('lz') in the test-case and comparing it to 'lzo' with strncmp() and a length of 3. strncmp() read past the 'lz' when looking for the 'o' and thus caused an out-of-bounds read. Introduce a new check 'btrfs_compress_is_valid_type()' which not only checks the user-supplied value against known compression types, but also employs checks for too short values. Reported-by: Nikolay Borisov <nborisov@suse.com> Fixes: 272e5326c783 ("btrfs: prop: fix vanished compression property after failed set") CC: stable@vger.kernel.org # 5.1+ Reviewed-by: Nikolay Borisov <nborisov@suse.com> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
423 lines
9.4 KiB
C
423 lines
9.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2014 Filipe David Borba Manana <fdmanana@gmail.com>
|
|
*/
|
|
|
|
#include <linux/hashtable.h>
|
|
#include "props.h"
|
|
#include "btrfs_inode.h"
|
|
#include "transaction.h"
|
|
#include "ctree.h"
|
|
#include "xattr.h"
|
|
#include "compression.h"
|
|
|
|
#define BTRFS_PROP_HANDLERS_HT_BITS 8
|
|
static DEFINE_HASHTABLE(prop_handlers_ht, BTRFS_PROP_HANDLERS_HT_BITS);
|
|
|
|
struct prop_handler {
|
|
struct hlist_node node;
|
|
const char *xattr_name;
|
|
int (*validate)(const char *value, size_t len);
|
|
int (*apply)(struct inode *inode, const char *value, size_t len);
|
|
const char *(*extract)(struct inode *inode);
|
|
int inheritable;
|
|
};
|
|
|
|
static int prop_compression_validate(const char *value, size_t len);
|
|
static int prop_compression_apply(struct inode *inode,
|
|
const char *value,
|
|
size_t len);
|
|
static const char *prop_compression_extract(struct inode *inode);
|
|
|
|
static struct prop_handler prop_handlers[] = {
|
|
{
|
|
.xattr_name = XATTR_BTRFS_PREFIX "compression",
|
|
.validate = prop_compression_validate,
|
|
.apply = prop_compression_apply,
|
|
.extract = prop_compression_extract,
|
|
.inheritable = 1
|
|
},
|
|
};
|
|
|
|
void __init btrfs_props_init(void)
|
|
{
|
|
int i;
|
|
|
|
hash_init(prop_handlers_ht);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(prop_handlers); i++) {
|
|
struct prop_handler *p = &prop_handlers[i];
|
|
u64 h = btrfs_name_hash(p->xattr_name, strlen(p->xattr_name));
|
|
|
|
hash_add(prop_handlers_ht, &p->node, h);
|
|
}
|
|
}
|
|
|
|
static const struct hlist_head *find_prop_handlers_by_hash(const u64 hash)
|
|
{
|
|
struct hlist_head *h;
|
|
|
|
h = &prop_handlers_ht[hash_min(hash, BTRFS_PROP_HANDLERS_HT_BITS)];
|
|
if (hlist_empty(h))
|
|
return NULL;
|
|
|
|
return h;
|
|
}
|
|
|
|
static const struct prop_handler *
|
|
find_prop_handler(const char *name,
|
|
const struct hlist_head *handlers)
|
|
{
|
|
struct prop_handler *h;
|
|
|
|
if (!handlers) {
|
|
u64 hash = btrfs_name_hash(name, strlen(name));
|
|
|
|
handlers = find_prop_handlers_by_hash(hash);
|
|
if (!handlers)
|
|
return NULL;
|
|
}
|
|
|
|
hlist_for_each_entry(h, handlers, node)
|
|
if (!strcmp(h->xattr_name, name))
|
|
return h;
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static int __btrfs_set_prop(struct btrfs_trans_handle *trans,
|
|
struct inode *inode,
|
|
const char *name,
|
|
const char *value,
|
|
size_t value_len,
|
|
int flags)
|
|
{
|
|
const struct prop_handler *handler;
|
|
int ret;
|
|
|
|
if (strlen(name) <= XATTR_BTRFS_PREFIX_LEN)
|
|
return -EINVAL;
|
|
|
|
handler = find_prop_handler(name, NULL);
|
|
if (!handler)
|
|
return -EINVAL;
|
|
|
|
if (value_len == 0) {
|
|
ret = btrfs_setxattr(trans, inode, handler->xattr_name,
|
|
NULL, 0, flags);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = handler->apply(inode, NULL, 0);
|
|
ASSERT(ret == 0);
|
|
|
|
return ret;
|
|
}
|
|
|
|
ret = handler->validate(value, value_len);
|
|
if (ret)
|
|
return ret;
|
|
ret = btrfs_setxattr(trans, inode, handler->xattr_name,
|
|
value, value_len, flags);
|
|
if (ret)
|
|
return ret;
|
|
ret = handler->apply(inode, value, value_len);
|
|
if (ret) {
|
|
btrfs_setxattr(trans, inode, handler->xattr_name,
|
|
NULL, 0, flags);
|
|
return ret;
|
|
}
|
|
|
|
set_bit(BTRFS_INODE_HAS_PROPS, &BTRFS_I(inode)->runtime_flags);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int btrfs_set_prop(struct inode *inode,
|
|
const char *name,
|
|
const char *value,
|
|
size_t value_len,
|
|
int flags)
|
|
{
|
|
return __btrfs_set_prop(NULL, inode, name, value, value_len, flags);
|
|
}
|
|
|
|
static int iterate_object_props(struct btrfs_root *root,
|
|
struct btrfs_path *path,
|
|
u64 objectid,
|
|
void (*iterator)(void *,
|
|
const struct prop_handler *,
|
|
const char *,
|
|
size_t),
|
|
void *ctx)
|
|
{
|
|
int ret;
|
|
char *name_buf = NULL;
|
|
char *value_buf = NULL;
|
|
int name_buf_len = 0;
|
|
int value_buf_len = 0;
|
|
|
|
while (1) {
|
|
struct btrfs_key key;
|
|
struct btrfs_dir_item *di;
|
|
struct extent_buffer *leaf;
|
|
u32 total_len, cur, this_len;
|
|
int slot;
|
|
const struct hlist_head *handlers;
|
|
|
|
slot = path->slots[0];
|
|
leaf = path->nodes[0];
|
|
|
|
if (slot >= btrfs_header_nritems(leaf)) {
|
|
ret = btrfs_next_leaf(root, path);
|
|
if (ret < 0)
|
|
goto out;
|
|
else if (ret > 0)
|
|
break;
|
|
continue;
|
|
}
|
|
|
|
btrfs_item_key_to_cpu(leaf, &key, slot);
|
|
if (key.objectid != objectid)
|
|
break;
|
|
if (key.type != BTRFS_XATTR_ITEM_KEY)
|
|
break;
|
|
|
|
handlers = find_prop_handlers_by_hash(key.offset);
|
|
if (!handlers)
|
|
goto next_slot;
|
|
|
|
di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
|
|
cur = 0;
|
|
total_len = btrfs_item_size_nr(leaf, slot);
|
|
|
|
while (cur < total_len) {
|
|
u32 name_len = btrfs_dir_name_len(leaf, di);
|
|
u32 data_len = btrfs_dir_data_len(leaf, di);
|
|
unsigned long name_ptr, data_ptr;
|
|
const struct prop_handler *handler;
|
|
|
|
this_len = sizeof(*di) + name_len + data_len;
|
|
name_ptr = (unsigned long)(di + 1);
|
|
data_ptr = name_ptr + name_len;
|
|
|
|
if (name_len <= XATTR_BTRFS_PREFIX_LEN ||
|
|
memcmp_extent_buffer(leaf, XATTR_BTRFS_PREFIX,
|
|
name_ptr,
|
|
XATTR_BTRFS_PREFIX_LEN))
|
|
goto next_dir_item;
|
|
|
|
if (name_len >= name_buf_len) {
|
|
kfree(name_buf);
|
|
name_buf_len = name_len + 1;
|
|
name_buf = kmalloc(name_buf_len, GFP_NOFS);
|
|
if (!name_buf) {
|
|
ret = -ENOMEM;
|
|
goto out;
|
|
}
|
|
}
|
|
read_extent_buffer(leaf, name_buf, name_ptr, name_len);
|
|
name_buf[name_len] = '\0';
|
|
|
|
handler = find_prop_handler(name_buf, handlers);
|
|
if (!handler)
|
|
goto next_dir_item;
|
|
|
|
if (data_len > value_buf_len) {
|
|
kfree(value_buf);
|
|
value_buf_len = data_len;
|
|
value_buf = kmalloc(data_len, GFP_NOFS);
|
|
if (!value_buf) {
|
|
ret = -ENOMEM;
|
|
goto out;
|
|
}
|
|
}
|
|
read_extent_buffer(leaf, value_buf, data_ptr, data_len);
|
|
|
|
iterator(ctx, handler, value_buf, data_len);
|
|
next_dir_item:
|
|
cur += this_len;
|
|
di = (struct btrfs_dir_item *)((char *) di + this_len);
|
|
}
|
|
|
|
next_slot:
|
|
path->slots[0]++;
|
|
}
|
|
|
|
ret = 0;
|
|
out:
|
|
btrfs_release_path(path);
|
|
kfree(name_buf);
|
|
kfree(value_buf);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void inode_prop_iterator(void *ctx,
|
|
const struct prop_handler *handler,
|
|
const char *value,
|
|
size_t len)
|
|
{
|
|
struct inode *inode = ctx;
|
|
struct btrfs_root *root = BTRFS_I(inode)->root;
|
|
int ret;
|
|
|
|
ret = handler->apply(inode, value, len);
|
|
if (unlikely(ret))
|
|
btrfs_warn(root->fs_info,
|
|
"error applying prop %s to ino %llu (root %llu): %d",
|
|
handler->xattr_name, btrfs_ino(BTRFS_I(inode)),
|
|
root->root_key.objectid, ret);
|
|
else
|
|
set_bit(BTRFS_INODE_HAS_PROPS, &BTRFS_I(inode)->runtime_flags);
|
|
}
|
|
|
|
int btrfs_load_inode_props(struct inode *inode, struct btrfs_path *path)
|
|
{
|
|
struct btrfs_root *root = BTRFS_I(inode)->root;
|
|
u64 ino = btrfs_ino(BTRFS_I(inode));
|
|
int ret;
|
|
|
|
ret = iterate_object_props(root, path, ino, inode_prop_iterator, inode);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int inherit_props(struct btrfs_trans_handle *trans,
|
|
struct inode *inode,
|
|
struct inode *parent)
|
|
{
|
|
struct btrfs_root *root = BTRFS_I(inode)->root;
|
|
struct btrfs_fs_info *fs_info = root->fs_info;
|
|
int ret;
|
|
int i;
|
|
|
|
if (!test_bit(BTRFS_INODE_HAS_PROPS,
|
|
&BTRFS_I(parent)->runtime_flags))
|
|
return 0;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(prop_handlers); i++) {
|
|
const struct prop_handler *h = &prop_handlers[i];
|
|
const char *value;
|
|
u64 num_bytes;
|
|
|
|
if (!h->inheritable)
|
|
continue;
|
|
|
|
value = h->extract(parent);
|
|
if (!value)
|
|
continue;
|
|
|
|
num_bytes = btrfs_calc_trans_metadata_size(fs_info, 1);
|
|
ret = btrfs_block_rsv_add(root, trans->block_rsv,
|
|
num_bytes, BTRFS_RESERVE_NO_FLUSH);
|
|
if (ret)
|
|
goto out;
|
|
ret = __btrfs_set_prop(trans, inode, h->xattr_name,
|
|
value, strlen(value), 0);
|
|
btrfs_block_rsv_release(fs_info, trans->block_rsv, num_bytes);
|
|
if (ret)
|
|
goto out;
|
|
}
|
|
ret = 0;
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
int btrfs_inode_inherit_props(struct btrfs_trans_handle *trans,
|
|
struct inode *inode,
|
|
struct inode *dir)
|
|
{
|
|
if (!dir)
|
|
return 0;
|
|
|
|
return inherit_props(trans, inode, dir);
|
|
}
|
|
|
|
int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
|
|
struct btrfs_root *root,
|
|
struct btrfs_root *parent_root)
|
|
{
|
|
struct super_block *sb = root->fs_info->sb;
|
|
struct btrfs_key key;
|
|
struct inode *parent_inode, *child_inode;
|
|
int ret;
|
|
|
|
key.objectid = BTRFS_FIRST_FREE_OBJECTID;
|
|
key.type = BTRFS_INODE_ITEM_KEY;
|
|
key.offset = 0;
|
|
|
|
parent_inode = btrfs_iget(sb, &key, parent_root, NULL);
|
|
if (IS_ERR(parent_inode))
|
|
return PTR_ERR(parent_inode);
|
|
|
|
child_inode = btrfs_iget(sb, &key, root, NULL);
|
|
if (IS_ERR(child_inode)) {
|
|
iput(parent_inode);
|
|
return PTR_ERR(child_inode);
|
|
}
|
|
|
|
ret = inherit_props(trans, child_inode, parent_inode);
|
|
iput(child_inode);
|
|
iput(parent_inode);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int prop_compression_validate(const char *value, size_t len)
|
|
{
|
|
if (btrfs_compress_is_valid_type(value, len))
|
|
return 0;
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
static int prop_compression_apply(struct inode *inode,
|
|
const char *value,
|
|
size_t len)
|
|
{
|
|
struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
|
|
int type;
|
|
|
|
if (len == 0) {
|
|
BTRFS_I(inode)->flags |= BTRFS_INODE_NOCOMPRESS;
|
|
BTRFS_I(inode)->flags &= ~BTRFS_INODE_COMPRESS;
|
|
BTRFS_I(inode)->prop_compress = BTRFS_COMPRESS_NONE;
|
|
|
|
return 0;
|
|
}
|
|
|
|
if (!strncmp("lzo", value, 3)) {
|
|
type = BTRFS_COMPRESS_LZO;
|
|
btrfs_set_fs_incompat(fs_info, COMPRESS_LZO);
|
|
} else if (!strncmp("zlib", value, 4)) {
|
|
type = BTRFS_COMPRESS_ZLIB;
|
|
} else if (!strncmp("zstd", value, 4)) {
|
|
type = BTRFS_COMPRESS_ZSTD;
|
|
btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD);
|
|
} else {
|
|
return -EINVAL;
|
|
}
|
|
|
|
BTRFS_I(inode)->flags &= ~BTRFS_INODE_NOCOMPRESS;
|
|
BTRFS_I(inode)->flags |= BTRFS_INODE_COMPRESS;
|
|
BTRFS_I(inode)->prop_compress = type;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const char *prop_compression_extract(struct inode *inode)
|
|
{
|
|
switch (BTRFS_I(inode)->prop_compress) {
|
|
case BTRFS_COMPRESS_ZLIB:
|
|
case BTRFS_COMPRESS_LZO:
|
|
case BTRFS_COMPRESS_ZSTD:
|
|
return btrfs_compress_type2str(BTRFS_I(inode)->prop_compress);
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
|