This is a note to let you know that I've just added the patch titled
xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfs-reject-crazy-array-sizes-being-fed-to-xfs_ioc_getbmap.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Tue Aug 23 09:20:27 AM CEST 2022
From: Leah Rumancik <leah.rumancik@xxxxxxxxx>
Date: Fri, 19 Aug 2022 11:14:31 -0700
Subject: xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*
To: stable@xxxxxxxxxxxxxxx
Cc: linux-xfs@xxxxxxxxxxxxxxx, amir73il@xxxxxxxxx, "Darrick J. Wong" <djwong@xxxxxxxxxx>, Allison Henderson <allison.henderson@xxxxxxxxxx>, Catherine Hoang <catherine.hoang@xxxxxxxxxx>, Leah Rumancik <leah.rumancik@xxxxxxxxx>
Message-ID: <20220819181431.4113819-10-leah.rumancik@xxxxxxxxx>
From: "Darrick J. Wong" <djwong@xxxxxxxxxx>
[ Upstream commit 29d650f7e3ab55283b89c9f5883d0c256ce478b5 ]
Syzbot tripped over the following complaint from the kernel:
WARNING: CPU: 2 PID: 15402 at mm/util.c:597 kvmalloc_node+0x11e/0x125 mm/util.c:597
While trying to run XFS_IOC_GETBMAP against the following structure:
struct getbmap fubar = {
.bmv_count = 0x22dae649,
};
Obviously, this is a crazy huge value since the next thing that the
ioctl would do is allocate 37GB of memory. This is enough to make
kvmalloc mad, but isn't large enough to trip the validation functions.
In other words, I'm fussing with checks that were **already sufficient**
because that's easier than dealing with 644 internal bug reports. Yes,
that's right, six hundred and forty-four.
Signed-off-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Reviewed-by: Allison Henderson <allison.henderson@xxxxxxxxxx>
Reviewed-by: Catherine Hoang <catherine.hoang@xxxxxxxxxx>
Signed-off-by: Leah Rumancik <leah.rumancik@xxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/xfs_ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1545,7 +1545,7 @@ xfs_ioc_getbmap(
if (bmx.bmv_count < 2)
return -EINVAL;
- if (bmx.bmv_count > ULONG_MAX / recsize)
+ if (bmx.bmv_count >= INT_MAX / recsize)
return -ENOMEM;
buf = kvzalloc(bmx.bmv_count * sizeof(*buf), GFP_KERNEL);
Patches currently in stable-queue which might be from leah.rumancik@xxxxxxxxx are
queue-5.15/xfs-remove-infinite-loop-when-reserving-free-block-pool.patch
queue-5.15/xfs-reserve-quota-for-target-dir-expansion-when-renaming-files.patch
queue-5.15/xfs-fix-soft-lockup-via-spinning-in-filestream-ag-selection-loop.patch
queue-5.15/xfs-flush-inodegc-workqueue-tasks-before-cancel.patch
queue-5.15/xfs-revert-xfs-actually-bump-warning-counts-when-we-send-warnings.patch
queue-5.15/xfs-reserve-quota-for-dir-expansion-when-linking-unlinking-files.patch
queue-5.15/xfs-fix-overfilling-of-reserve-pool.patch
queue-5.15/xfs-reject-crazy-array-sizes-being-fed-to-xfs_ioc_getbmap.patch
queue-5.15/xfs-always-succeed-at-setting-the-reserve-pool-size.patch
