[PATCH] xfs: fix out-of-bounds cursor access from rtrmap level off-by-one

[PATCH] xfs: fix out-of-bounds cursor access from rtrmap level off-by-one

[Henry Martin]

m_rtrmap_maxlevels includes the inode root level, so a valid on-disk
bb_level is strictly less than m_rtrmap_maxlevels.  Both
xfs_rtrmapbt_verify() and xfs_iformat_rtrmap() compare with ">"
instead of ">=", letting a forged block with level == maxlevels pass
validation.  The cursor is then sized for maxlevels entries while
bc_nlevels is set to level + 1, so the generic btree code indexes one
element past bc_levels[] - an out-of-bounds read/write on the cursor
allocation.

xfs_rtrmapbt_mem_verify() in the same file (from commit
4a61f12eb1195 "xfs: create a shadow rmap btree during realtime rmap
repair") already uses ">=".

This vulnerability was discovered by Tencent CodeBuddy Security.

Cc: stable@vger.kernel.org
Fixes: fc6856c6ff086 ("xfs: introduce realtime rmap btree ondisk definitions")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 fs/xfs/libxfs/xfs_rtrmap_btree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_rtrmap_btree.c b/fs/xfs/libxfs/xfs_rtrmap_btree.c
index a15e460a1ec7..6833c924a383 100644
--- a/fs/xfs/libxfs/xfs_rtrmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rtrmap_btree.c
@@ -256,7 +256,7 @@ xfs_rtrmapbt_verify(
 	if (fa)
 		return fa;
 	level = be16_to_cpu(block->bb_level);
-	if (level > mp->m_rtrmap_maxlevels)
+	if (level >= mp->m_rtrmap_maxlevels)
 		return __this_address;

 	return xfs_btree_fsblock_verify(bp, mp->m_rtrmap_mxr[level != 0]);
@@ -888,7 +888,7 @@ xfs_iformat_rtrmap(
 	numrecs = be16_to_cpu(dfp->bb_numrecs);
 	level = be16_to_cpu(dfp->bb_level);

-	if (level > mp->m_rtrmap_maxlevels ||
+	if (level >= mp->m_rtrmap_maxlevels ||
 	    xfs_rtrmap_droot_space_calc(level, numrecs) > dsize) {
 		xfs_inode_mark_sick(ip, XFS_SICK_INO_CORE);
 		return -EFSCORRUPTED;
--
2.43.7

Re: [PATCH] xfs: fix out-of-bounds cursor access from rtrmap level off-by-one

[Carlos Maiolino]

On Fri, Oct 09, 2026 at 07:45:03PM +0800, Henry Martin wrote:
> m_rtrmap_maxlevels includes the inode root level, so a valid on-disk
> bb_level is strictly less than m_rtrmap_maxlevels.  Both
> xfs_rtrmapbt_verify() and xfs_iformat_rtrmap() compare with ">"
> instead of ">=", letting a forged block with level == maxlevels pass
> validation.

So you need a maliciously crafted filesystem image and enough privileges
to be able to mount it.

> The cursor is then sized for maxlevels entries while
> bc_nlevels is set to level + 1, so the generic btree code indexes one
> element past bc_levels[] - an out-of-bounds read/write on the cursor
> allocation.
> 
> xfs_rtrmapbt_mem_verify() in the same file (from commit
> 4a61f12eb1195 "xfs: create a shadow rmap btree during realtime rmap
> repair") already uses ">=".
> 
> This vulnerability was discovered by Tencent CodeBuddy Security.

What is the "vulnerability" you are claiming here? How can this be
exploited? For what you described, it requires a crafted filesystem
image, which should require a privileged user to mount, so while this is
a bug, calling it a vulnerability is a big stretch.
So, giving you claimed it to be a vulnerability, how can it be
exploited by a non-privileged user? Where is the reproducer? You can
even share it off-list if you prefer.

> 
> Cc: stable@vger.kernel.org
> Fixes: fc6856c6ff086 ("xfs: introduce realtime rmap btree ondisk definitions")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  fs/xfs/libxfs/xfs_rtrmap_btree.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_rtrmap_btree.c b/fs/xfs/libxfs/xfs_rtrmap_btree.c
> index a15e460a1ec7..6833c924a383 100644
> --- a/fs/xfs/libxfs/xfs_rtrmap_btree.c
> +++ b/fs/xfs/libxfs/xfs_rtrmap_btree.c
> @@ -256,7 +256,7 @@ xfs_rtrmapbt_verify(
>  	if (fa)
>  		return fa;
>  	level = be16_to_cpu(block->bb_level);
> -	if (level > mp->m_rtrmap_maxlevels)
> +	if (level >= mp->m_rtrmap_maxlevels)
>  		return __this_address;
> 
>  	return xfs_btree_fsblock_verify(bp, mp->m_rtrmap_mxr[level != 0]);
> @@ -888,7 +888,7 @@ xfs_iformat_rtrmap(
>  	numrecs = be16_to_cpu(dfp->bb_numrecs);
>  	level = be16_to_cpu(dfp->bb_level);
> 
> -	if (level > mp->m_rtrmap_maxlevels ||
> +	if (level >= mp->m_rtrmap_maxlevels ||
>  	    xfs_rtrmap_droot_space_calc(level, numrecs) > dsize) {
>  		xfs_inode_mark_sick(ip, XFS_SICK_INO_CORE);
>  		return -EFSCORRUPTED;
> --
> 2.43.7
> 
>