From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f196.google.com (mail-pf1-f196.google.com [209.85.210.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4042B3CF024 for ; Sat, 13 Jun 2026 11:05:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.196 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781348735; cv=none; b=JCpu5XsQoYU4sYXJ58ao6um/bPJOh4zjirEjyh7jMlyd4roJKDxZwn/ouIR+8j/BhCsecx4yQm3ttIC3cYk4So1Z0uMkOASzSEbNkDwdimCp5MSFCQlr7ZJDVgAiZ3CKwBMCwbYlj4i1Rq1mVHqpTGPGGExDHrJj49BhxiT/RmM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781348735; c=relaxed/simple; bh=W/loW5EsJ0DC6CNn8nw7gVK9GI5/SgS3XbvVegp1IKQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=GqydsHmY2WHMeFXq337MB8BeLI5IWPvPNjXUBwjW3RSkOo4XhdVAgx5lZIP3luZe4qHdU6ifPz2Sxj1KjBuCqBCcfNBLaildyFFaqAfHDHvR8KHztuNz0PeMKWGtKD5q+5jg004XDADhhRe76cavvNW8s/HGrJOmVdF+lIbKArk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qG6HRGPv; arc=none smtp.client-ip=209.85.210.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qG6HRGPv" Received: by mail-pf1-f196.google.com with SMTP id d2e1a72fcca58-8424b6792efso805134b3a.3 for ; Sat, 13 Jun 2026 04:05:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781348733; x=1781953533; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pBdRLyUsJiYShnn2wOSBi8GYR+LxVfalSBx2Fe/OETI=; b=qG6HRGPvbnX/0vvwpnwCSaT1rj5xNZBXOPyB6E59op2BsfcrlzbRiJn1a0XwZoRtMZ pLcOv8m4arWjWlTiQFC2FU02LRlvkozMkcls0Kok6mvJ/SndM3TmWlPP4qFOyix3BjjQ awL8HZCe9CD+AVFGzh8l2poZ1W5tYTKr8rpFwucoreA/JU3U3tHQV4PcXnBiFh4jv+QI 467W1VpWKro9JO1NC/zmVwiAKM7LCqcIAQWRlz4Rb8frKPJkNGmdtIcr3iJ9lrDjjPvf a2Wxvfg4NsoxnmAyIOxrgWPApyinv1dhTpcTYxFQ1LrkOCn+tfg4tAiFWYk9bUnrioSm 5SOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781348733; x=1781953533; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pBdRLyUsJiYShnn2wOSBi8GYR+LxVfalSBx2Fe/OETI=; b=CHVwb3qoArOm82AHw9AkBjl+qhLFsxLcZ215dRo81ye/yAz1NUKZBeOhjOeujHvBmG f+sAkX45MrqU+gEkYQLkWUl4Gl/rsprgmp1wN3au9vevCiwH64XVhp/w929zf6aw0rJu UA+EkWHBfpf9Q5VdmhyfrArNVqG4El+v23iJJx4Vw24DEerkXHyLpSVt8d2jRa7hRJsu AMhhqNXzClsJ6HTEsrAotBTit2HFqeNM4rNiqBtF/ZfxdvGyr1njM0ohl04fj+ndL+OG APR6CGA8AsnXl9aNXB0KogBwbka3HswUIRMgImUce2lLzTapgdI/s8W3MOWIdkOzqzCt jyVw== X-Forwarded-Encrypted: i=1; AFNElJ9mlhW4fdyyUwQdsuR4+2pH0aKE/GSzNaWRoVIzS231l7aVc46SZqU/ItTrzBEes5jjlLAVvqU1bchOAR4=@vger.kernel.org X-Gm-Message-State: AOJu0YwudNAc7G2HL0KPQC2swOoU0W9GaOK2ZWIWScW6KXjz9g/9uaHw tITo8PFHqXeb81pK3JowQV7zqym4FSAJu/b5T/aEieqMNyK66LMY2ZEm X-Gm-Gg: Acq92OEkTQs4ULBh8MEqydQuRoUIjIsfVUJP4DX3Gq5XHzX9X/UymULIgMHO06gdq46 orAI3prsJ6kO03NV6ritutPE1syLYtQK8IT7QFHAdK3mPOBGZfF/9js8sJNpvbBiI2ujTEof+Vy tpogyTFFDtTb8qibK+G+xkgJhHHQ+CQGMRvHVwByMrznIsuaZUgYK9yvtQ8ugBhJqr+717JJNyg +W8xkCaxsfB7J3Rb101veP/Gi9ztZp0Es+h0JKZ37LnbsYaAr+qIewzCt0oqDcT5CAbrnTDKxuz ggMQor+kKuJ65CqIVBpZLaymKx09dzJHN2T0aOHLI46IB/D6Lr7A/8YaMq0Ug1pAbHgGM0IrBZX E2gfaUZ6qZnCld/tSaGqh/8KeEBJeEtNu0z5v+5YfsHe6xmtemdiPifNji9ULbHwWVw0hQY7/KE eq5aqvAU6/2HpGmplOimfJ X-Received: by 2002:a05:6a00:984:b0:842:5b66:3c7f with SMTP id d2e1a72fcca58-844e1590761mr3744376b3a.0.1781348733408; Sat, 13 Jun 2026 04:05:33 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434afd50e6sm4721723b3a.30.2026.06.13.04.05.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 Jun 2026 04:05:32 -0700 (PDT) From: Zhang Cen To: Jaegeuk Kim , Chao Yu Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, zerocling0077@gmail.com, 2045gemini@gmail.com, Zhang Cen Subject: [PATCH v2] f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Date: Sat, 13 Jun 2026 19:05:26 +0800 Message-Id: <20260613110526.1347194-1-rollkingzzc@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Require a short entry before reading e_tag and e_perm, and require a full entry before reading e_id for ACL_USER and ACL_GROUP. Return -EFSCORRUPTED for malformed on-disk ACL blobs so corrupted ACL xattrs are reported as filesystem corruption instead of generic invalid arguments. Validation reproduced this kernel report: KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 RIP: 0033:0x7f4b835ea7aa The buggy address belongs to the object at ffff888114589960 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888114589960, ffff888114589968) Read of size 4 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x224/0x430 (?:?) kasan_report+0xe0/0x110 (?:?) __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169) __get_acl+0x281/0x380 (?:?) vfs_get_acl+0x10b/0x190 (?:?) do_get_acl+0x2a/0x410 (?:?) do_get_acl+0x9/0x410 (?:?) do_getxattr+0xe8/0x260 (?:?) filename_getxattr+0xd1/0x140 (?:?) do_getname+0x2d/0x2d0 (?:?) path_getxattrat+0x16c/0x200 (?:?) lock_release+0xc8/0x290 (?:?) cgroup_update_frozen+0x9d/0x320 (?:?) lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?) trace_hardirqs_on+0x1a/0x170 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Fixes: af48b85b8cd3 ("f2fs: add xattr and acl functionalities") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen --- Changes in v2: - Wrap the new ACL entry-size checks in unlikely(). - Return -EFSCORRUPTED for malformed on-disk ACL blobs. fs/f2fs/acl.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c index fa8d81a30fb91..e62ce979be0b7 100644 --- a/fs/f2fs/acl.c +++ b/fs/f2fs/acl.c @@ -53,14 +53,14 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size) const char *end = value + size; if (size < sizeof(struct f2fs_acl_header)) - return ERR_PTR(-EINVAL); + return ERR_PTR(-EFSCORRUPTED); if (hdr->a_version != cpu_to_le32(F2FS_ACL_VERSION)) - return ERR_PTR(-EINVAL); + return ERR_PTR(-EFSCORRUPTED); count = f2fs_acl_count(size); if (count < 0) - return ERR_PTR(-EINVAL); + return ERR_PTR(-EFSCORRUPTED); if (count == 0) return NULL; @@ -70,7 +70,8 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size) for (i = 0; i < count; i++) { - if ((char *)entry > end) + if (unlikely((char *)entry + + sizeof(struct f2fs_acl_entry_short) > end)) goto fail; acl->a_entries[i].e_tag = le16_to_cpu(entry->e_tag); @@ -86,6 +87,9 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size) break; case ACL_USER: + if (unlikely((char *)entry + + sizeof(struct f2fs_acl_entry) > end)) + goto fail; acl->a_entries[i].e_uid = make_kuid(&init_user_ns, le32_to_cpu(entry->e_id)); @@ -93,6 +97,9 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size) sizeof(struct f2fs_acl_entry)); break; case ACL_GROUP: + if (unlikely((char *)entry + + sizeof(struct f2fs_acl_entry) > end)) + goto fail; acl->a_entries[i].e_gid = make_kgid(&init_user_ns, le32_to_cpu(entry->e_id)); @@ -108,7 +115,7 @@ static struct posix_acl *f2fs_acl_from_disk(const char *value, size_t size) return acl; fail: posix_acl_release(acl); - return ERR_PTR(-EINVAL); + return ERR_PTR(-EFSCORRUPTED); } static void *f2fs_acl_to_disk(struct f2fs_sb_info *sbi, -- 2.43.0