Commit b0cc3ae9 authored by Junrui Luo's avatar Junrui Luo Committed by Yu Kuai
Browse files

md/raid5: validate payload size before accessing journal metadata 



r5c_recovery_analyze_meta_block() and
r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a
journal metadata block using on-disk payload size fields without
validating them against the remaining space in the metadata block.

A corrupted journal contains payload sizes extending beyond the PAGE_SIZE
boundary can cause out-of-bounds reads when accessing payload fields or
computing offsets.

Add bounds validation for each payload type to ensure the full payload
fits within meta_size before processing.

Fixes: b4c625c6 ("md/r5cache: r5cache recovery: part 1")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@SYBPR01MB7881.ausprd01.prod.outlook.com/


Signed-off-by: default avatarYu Kuai <yukuai@fnnas.com>
parent e4979f4f

drivers/md/raid5-cache.c

+33 −15
Original line number Diff line number Diff line
@@ -2002,15 +2002,27 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log, 
		return -ENOMEM;



	while (mb_offset < le32_to_cpu(mb->meta_size)) {

		sector_t payload_len;



		payload = (void *)mb + mb_offset;

		payload_flush = (void *)mb + mb_offset;



		if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) {

			payload_len = sizeof(struct r5l_payload_data_parity) +

				(sector_t)sizeof(__le32) *

				(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))

				goto mismatch;

			if (r5l_recovery_verify_data_checksum(

				    log, ctx, page, log_offset,

				    payload->checksum[0]) < 0)

				goto mismatch;

		} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) {

			payload_len = sizeof(struct r5l_payload_data_parity) +

				(sector_t)sizeof(__le32) *

				(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))

				goto mismatch;

			if (r5l_recovery_verify_data_checksum(

				    log, ctx, page, log_offset,

				    payload->checksum[0]) < 0)
@@ -2023,22 +2035,18 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log, 
				    payload->checksum[1]) < 0)

				goto mismatch;

		} else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {

			/* nothing to do for R5LOG_PAYLOAD_FLUSH here */

			payload_len = sizeof(struct r5l_payload_flush) +

				(sector_t)le32_to_cpu(payload_flush->size);

			if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))

				goto mismatch;

		} else /* not R5LOG_PAYLOAD_DATA/PARITY/FLUSH */

			goto mismatch;



		if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {

			mb_offset += sizeof(struct r5l_payload_flush) +

				le32_to_cpu(payload_flush->size);

		} else {

			/* DATA or PARITY payload */

		if (le16_to_cpu(payload->header.type) != R5LOG_PAYLOAD_FLUSH) {

			log_offset = r5l_ring_add(log, log_offset,

						  le32_to_cpu(payload->size));

			mb_offset += sizeof(struct r5l_payload_data_parity) +

				sizeof(__le32) *

				(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

		}



		mb_offset += payload_len;

	}



	put_page(page);
@@ -2089,6 +2097,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, 
	log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS);



	while (mb_offset < le32_to_cpu(mb->meta_size)) {

		sector_t payload_len;

		int dd;



		payload = (void *)mb + mb_offset;
@@ -2097,6 +2106,12 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, 
		if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {

			int i, count;



			payload_len = sizeof(struct r5l_payload_flush) +

				(sector_t)le32_to_cpu(payload_flush->size);

			if (mb_offset + payload_len >

			    le32_to_cpu(mb->meta_size))

				return -EINVAL;



			count = le32_to_cpu(payload_flush->size) / sizeof(__le64);

			for (i = 0; i < count; ++i) {

				stripe_sect = le64_to_cpu(payload_flush->flush_stripes[i]);
@@ -2110,12 +2125,17 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, 
				}

			}



			mb_offset += sizeof(struct r5l_payload_flush) +

				le32_to_cpu(payload_flush->size);

			mb_offset += payload_len;

			continue;

		}



		/* DATA or PARITY payload */

		payload_len = sizeof(struct r5l_payload_data_parity) +

			(sector_t)sizeof(__le32) *

			(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

		if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))

			return -EINVAL;



		stripe_sect = (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) ?

			raid5_compute_sector(

				conf, le64_to_cpu(payload->location), 0, &dd,
@@ -2180,9 +2200,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, 
		log_offset = r5l_ring_add(log, log_offset,

					  le32_to_cpu(payload->size));



		mb_offset += sizeof(struct r5l_payload_data_parity) +

			sizeof(__le32) *

			(le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));

		mb_offset += payload_len;

	}



	return 0;