[BUG] gfs2: WARNING in gfs2_check_blk_type on a crafted image

[CJ <firefly0158@163.com>]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts a crafted GFS2 image and then calls
open_by_handle_at() with a hand-built small file handle. No ordinary file
operation is needed; the failure comes from resolving that handle.


Resolving the handle runs gfs2_fh_to_dentry() -> gfs2_lookup_by_inum() ->
gfs2_inode_lookup() -> gfs2_check_blk_type(). The block address taken from
the handle cannot be mapped into its resource group, so
gfs2_rbm_from_block() returns an error and the WARN_ON_ONCE() in
gfs2_check_blk_type() fires. The work is done in the calling task's syscall
context.


This looks like the block number in the file handle being used before it is
checked against the resource group it claims to belong to. Because
open_by_handle_at() is reachable with unprivileged, user-supplied handles,
validating the block address against the resource group geometry before the
lookup would be the guard. I have not determined which field of the handle
carries the out-of-range block number.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=17b1d6e43bf67dcfc9c7, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:  https://pastebin.com/raw/V7BaNMRd
console output: https://pastebin.com/raw/hskt7QKp
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e1e9066810307299


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu