|
| 1 | +Squashfs: check the inode number is not the invalid value of zero |
| 2 | + |
| 3 | +jira LE-1907 |
| 4 | +cve CVE-2024-26982 |
| 5 | +Rebuild_History Non-Buildable kernel-5.14.0-427.28.1.el9_4 |
| 6 | +commit-author Phillip Lougher <phillip@squashfs.org.uk> |
| 7 | +commit 9253c54e01b6505d348afbc02abaa4d9f8a01395 |
| 8 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 9 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 10 | +ciq/ciq_backports/kernel-5.14.0-427.28.1.el9_4/9253c54e.failed |
| 11 | + |
| 12 | +Syskiller has produced an out of bounds access in fill_meta_index(). |
| 13 | + |
| 14 | +That out of bounds access is ultimately caused because the inode |
| 15 | +has an inode number with the invalid value of zero, which was not checked. |
| 16 | + |
| 17 | +The reason this causes the out of bounds access is due to following |
| 18 | +sequence of events: |
| 19 | + |
| 20 | +1. Fill_meta_index() is called to allocate (via empty_meta_index()) |
| 21 | + and fill a metadata index. It however suffers a data read error |
| 22 | + and aborts, invalidating the newly returned empty metadata index. |
| 23 | + It does this by setting the inode number of the index to zero, |
| 24 | + which means unused (zero is not a valid inode number). |
| 25 | + |
| 26 | +2. When fill_meta_index() is subsequently called again on another |
| 27 | + read operation, locate_meta_index() returns the previous index |
| 28 | + because it matches the inode number of 0. Because this index |
| 29 | + has been returned it is expected to have been filled, and because |
| 30 | + it hasn't been, an out of bounds access is performed. |
| 31 | + |
| 32 | +This patch adds a sanity check which checks that the inode number |
| 33 | +is not zero when the inode is created and returns -EINVAL if it is. |
| 34 | + |
| 35 | +[phillip@squashfs.org.uk: whitespace fix] |
| 36 | + Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk |
| 37 | +Link: https://lkml.kernel.org/r/20240408220206.435788-1-phillip@squashfs.org.uk |
| 38 | + Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> |
| 39 | + Reported-by: "Ubisectech Sirius" <bugreport@ubisectech.com> |
| 40 | +Closes: https://lore.kernel.org/lkml/87f5c007-b8a5-41ae-8b57-431e924c5915.bugreport@ubisectech.com/ |
| 41 | + Cc: Christian Brauner <brauner@kernel.org> |
| 42 | + Cc: <stable@vger.kernel.org> |
| 43 | + Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| 44 | +(cherry picked from commit 9253c54e01b6505d348afbc02abaa4d9f8a01395) |
| 45 | + Signed-off-by: Jonathan Maple <jmaple@ciq.com> |
| 46 | + |
| 47 | +# Conflicts: |
| 48 | +# fs/squashfs/inode.c |
| 49 | +diff --cc fs/squashfs/inode.c |
| 50 | +index 24463145b351,16bd693d0b3a..000000000000 |
| 51 | +--- a/fs/squashfs/inode.c |
| 52 | ++++ b/fs/squashfs/inode.c |
| 53 | +@@@ -58,10 -62,9 +62,16 @@@ static int squashfs_new_inode(struct su |
| 54 | + |
| 55 | + i_uid_write(inode, i_uid); |
| 56 | + i_gid_write(inode, i_gid); |
| 57 | +++<<<<<<< HEAD |
| 58 | + + inode->i_ino = le32_to_cpu(sqsh_ino->inode_number); |
| 59 | + + inode->i_mtime.tv_sec = le32_to_cpu(sqsh_ino->mtime); |
| 60 | + + inode->i_atime.tv_sec = inode->i_mtime.tv_sec; |
| 61 | + + inode->i_ctime.tv_sec = inode->i_mtime.tv_sec; |
| 62 | +++======= |
| 63 | ++ inode_set_mtime(inode, le32_to_cpu(sqsh_ino->mtime), 0); |
| 64 | ++ inode_set_atime(inode, inode_get_mtime_sec(inode), 0); |
| 65 | ++ inode_set_ctime(inode, inode_get_mtime_sec(inode), 0); |
| 66 | +++>>>>>>> 9253c54e01b6 (Squashfs: check the inode number is not the invalid value of zero) |
| 67 | + inode->i_mode = le16_to_cpu(sqsh_ino->mode); |
| 68 | + inode->i_size = 0; |
| 69 | + |
| 70 | +* Unmerged path fs/squashfs/inode.c |
0 commit comments