Commit 9ed50b82 authored by Gao Xiang's avatar Gao Xiang
Browse files

erofs: fix incorrect symlink detection in fast symlink 



Fast symlink can be used if the on-disk symlink data is stored
in the same block as the on-disk inode, so we don’t need to trigger
another I/O for symlink data.  However, currently fs correction could be
reported _incorrectly_ if inode xattrs are too large.

In fact, these should be valid images although they cannot be handled as
fast symlinks.

Many thanks to Colin for reporting this!

Reported-by: default avatarColin Walters <walters@verbum.org>
Reported-by: https://honggfuzz.dev/
Link: https://lore.kernel.org/r/bb2dd430-7de0-47da-ae5b-82ab2dd4d945@app.fastmail.com


Fixes: 431339ba ("staging: erofs: add inode operations")
[ Note that it's a runtime misbehavior instead of a security issue. ]
Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240909031911.1174718-1-hsiangkao@linux.alibaba.com
parent da3ea350

fs/erofs/inode.c

+6 −14
Original line number Diff line number Diff line
@@ -178,12 +178,14 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr, 
			      unsigned int m_pofs)

{

	struct erofs_inode *vi = EROFS_I(inode);

	unsigned int bsz = i_blocksize(inode);

	loff_t off;

	char *lnk;



	/* if it cannot be handled with fast symlink scheme */

	if (vi->datalayout != EROFS_INODE_FLAT_INLINE ||

	    inode->i_size >= bsz || inode->i_size < 0) {

	m_pofs += vi->xattr_isize;

	/* check if it cannot be handled with fast symlink scheme */

	if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||

	    check_add_overflow(m_pofs, inode->i_size, &off) ||

	    off > i_blocksize(inode)) {

		inode->i_op = &erofs_symlink_iops;

		return 0;

	}
@@ -192,16 +194,6 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr, 
	if (!lnk)

		return -ENOMEM;



	m_pofs += vi->xattr_isize;

	/* inline symlink data shouldn't cross block boundary */

	if (m_pofs + inode->i_size > bsz) {

		kfree(lnk);

		erofs_err(inode->i_sb,

			  "inline data cross block boundary @ nid %llu",

			  vi->nid);

		DBG_BUGON(1);

		return -EFSCORRUPTED;

	}

	memcpy(lnk, kaddr + m_pofs, inode->i_size);

	lnk[inode->i_size] = '\0';