Forwarded: [PATCH] ext4: don't trust on-disk rec_len in dx_move_dirents()

[syzbot <syzbot+09bec78ee77613a3efdd@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] ext4: don't trust on-disk rec_len in dx_move_dirents()
Author: adrianox@gmail.com

#syz test: upstream master
---
 fs/ext4/namei.c | 38 ++++++++++++++++++++++++++++++--------
 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f..83e4564f9f44 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1840,30 +1840,46 @@ struct dentry *ext4_get_parent(struct dentry *child)
 
 /*
  * Move count entries from end of map between two memory locations.
- * Returns pointer to last entry moved.
+ * Returns pointer to last entry moved or an ERR_PTR on a corrupt entry.
  */
 static struct ext4_dir_entry_2 *
 dx_move_dirents(struct inode *dir, char *from, char *to,
 		struct dx_map_entry *map, int count,
 		unsigned blocksize)
 {
+	char *to_start = to;
 	unsigned rec_len = 0;
 
 	while (count--) {
-		struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)
-						(from + (map->offs<<2));
+		unsigned int off = map->offs << 2;
+		struct ext4_dir_entry_2 *de;
+
+		/*
+		 * The map is built from on-disk dirents, but a corrupted or
+		 * concurrently reused leaf block can still make an entry point
+		 * outside the block.  Never dereference such an entry.
+		 */
+		if (off > blocksize - sizeof(struct ext4_dir_entry_2))
+			return ERR_PTR(-EFSCORRUPTED);
+		de = (struct ext4_dir_entry_2 *)(from + off);
 		rec_len = ext4_dir_rec_len(de->name_len, dir);
+		if (off + rec_len > blocksize ||
+		    to + rec_len > to_start + blocksize)
+			return ERR_PTR(-EFSCORRUPTED);
 
 		memcpy (to, de, rec_len);
 		((struct ext4_dir_entry_2 *) to)->rec_len =
 				ext4_rec_len_to_disk(rec_len, blocksize);
 
-		/* wipe dir_entry excluding the rec_len field */
+		/*
+		 * Wipe dir_entry excluding the rec_len field.  Use the entry's
+		 * own (minimal) length instead of the untrusted on-disk rec_len,
+		 * which on a corrupt block decodes to an arbitrary huge value
+		 * and turns this into an out-of-bounds memset().
+		 */
 		de->inode = 0;
-		memset(&de->name_len, 0, ext4_rec_len_from_disk(de->rec_len,
-								blocksize) -
-					 offsetof(struct ext4_dir_entry_2,
-								name_len));
+		memset(&de->name_len, 0, rec_len -
+		       offsetof(struct ext4_dir_entry_2, name_len));
 
 		map++;
 		to += rec_len;
@@ -1992,6 +2008,12 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
 	/* Fancy dance to stay within two buffers */
 	de2 = dx_move_dirents(dir, data1, data2, map + split, count - split,
 			      blocksize);
+	if (IS_ERR(de2)) {
+		ext4_error_inode_block(dir, (*bh)->b_blocknr, 0,
+				       "bad indexed directory entry");
+		err = PTR_ERR(de2);
+		goto out;
+	}
 	de = dx_pack_dirents(dir, data1, blocksize);
 	de->rec_len = ext4_rec_len_to_disk(data1 + (blocksize - csum_size) -
 					   (char *) de,
-- 
2.51.0