Forwarded: [PATCH] ext4: don't trust on-disk rec_len in dx_move_dirents()

[syzbot <syzbot+09bec78ee77613a3efdd@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] ext4: don't trust on-disk rec_len in dx_move_dirents()
Author: adrianox@gmail.com

#syz test: upstream master
syzbot reported an out-of-bounds write from do_split() while a directory
is converted to an indexed one:

  BUG: KASAN: slab-out-of-bounds in dx_move_dirents [inline]
  BUG: KASAN: slab-out-of-bounds in do_split+0xf9c/0x1de0
  Write of size 90458

dx_move_dirents() wipes the source entry using its on-disk rec_len.
That field can't be trusted: on a corrupt block it may be garbage
(0x6161 here) and ext4_rec_len_from_disk() turns it into a huge value,
so the memset() runs far past the block.  The entry is already copied
using its own real length, so use that length for the wipe as well.

Closes: https://syzkaller.appspot.com/bug?extid=09bec78ee77613a3efdd
---
 fs/ext4/namei.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f..71e9e7c9a7fd 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1860,10 +1860,8 @@ dx_move_dirents(struct inode *dir, char *from, char *to,
 
 		/* wipe dir_entry excluding the rec_len field */
 		de->inode = 0;
-		memset(&de->name_len, 0, ext4_rec_len_from_disk(de->rec_len,
-								blocksize) -
-					 offsetof(struct ext4_dir_entry_2,
-								name_len));
+		memset(&de->name_len, 0, rec_len -
+		       offsetof(struct ext4_dir_entry_2, name_len));
 
 		map++;
 		to += rec_len;
-- 
2.51.0