From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-124.freemail.mail.aliyun.com (out30-124.freemail.mail.aliyun.com [115.124.30.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91B53233937; Tue, 19 May 2026 12:22:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779193324; cv=none; b=KpzNdmdHdbN6POSULVXzmckb55Vkf4iCo16aeM3vZM8segpLe6KA+jgDvC7hzuSbohYBpkSLRkJUq2q31go+UXcsqzqbug2SOW9BqHREBCneGN9hPQeGlEXgSxFQX9HuPnQuCEMdqYXPnmujlm/FtGDBRkjwOG1teQd0KURbAfU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779193324; c=relaxed/simple; bh=/Q93K/C4W6YYklmiqCJ8k1DD2vn2A5uj5vydRSqg74c=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Z/tNyzBZ8IJUWCkFwRdferMOUr4YTGBF6kK7DKjPHPdsKNPk88nAOaBUIn8sWuiWbvj+K+Zluzz917FqN9C6zK2rq09iQ0wiSIesuVxH/+kTjVto8Jv+QrZhviKbFFDB6pNz3RBzTNGGVMKVUoqr4JxFZwNyiLG3bFPPaCkEaKQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=NLZLlzXN; arc=none smtp.client-ip=115.124.30.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="NLZLlzXN" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1779193313; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=0/0ijCf8EjrOXK9FgkE/9DEL5egLfJzCMGZkxQEE4sU=; b=NLZLlzXNWb9q4DAx7KC+spPEVaG+GsyYsSoNyFUrP9zJqljUNOsPBYylJMrHyKVSmB9LwJbJ+e8OQoKO1mzB47qvK038GrwSzD3wMXRhIu85vTZdFx5QBip0L9j6dQvb1jP+lkyIO0vTOCBy5iT4FVPnxUVGZac7sQh/QSCtXOY= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R141e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037009110;MF=joseph.qi@linux.alibaba.com;NM=1;PH=DS;RN=8;SR=0;TI=SMTPD_---0X3FV9sf_1779193312; Received: from 30.221.130.5(mailfrom:joseph.qi@linux.alibaba.com fp:SMTPD_---0X3FV9sf_1779193312 cluster:ay36) by smtp.aliyun-inc.com; Tue, 19 May 2026 20:21:52 +0800 Message-ID: <846077d4-e0de-4434-a41c-565c3ffbc5ec@linux.alibaba.com> Date: Tue, 19 May 2026 20:21:51 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 2/3] ocfs2: reject dinodes whose i_rdev disagrees with the file type To: Michael Bommarito , akpm Cc: ZhengYuan Huang , ocfs2-devel@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Fasheh , Joel Becker References: <20260519110404.1803902-1-michael.bommarito@gmail.com> <20260519110404.1803902-3-michael.bommarito@gmail.com> From: Joseph Qi In-Reply-To: <20260519110404.1803902-3-michael.bommarito@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 5/19/26 7:04 PM, Michael Bommarito wrote: > id1.dev1.i_rdev is the device-number arm of the ocfs2_dinode id1 union. > It is only meaningful for character and block device inodes. For any > other user-visible file type the on-disk value must be zero. > > ocfs2_populate_inode() currently copies id1.dev1.i_rdev into > inode->i_rdev before the S_IFMT switch decides whether the inode is a > special file. A non-device inode with a non-zero i_rdev can therefore > publish stale or attacker-controlled device state into the in-core inode. > > System inodes legitimately use other arms of the same union, so keep > the cross-check restricted to non-system inodes. Factor that predicate > into a helper and use it in both the normal validator and online > filecheck path; filecheck reports the malformed dinode through > OCFS2_FILECHECK_ERR_INVALIDINO instead of ocfs2_error(). > > Fixes: b657c95c1108 ("ocfs2: Wrap inode block reads in a dedicated function.") > Cc: stable@vger.kernel.org > Signed-off-by: Michael Bommarito > Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Joseph Qi > --- > fs/ocfs2/inode.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 55 insertions(+) > > diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c > index e149ccbdc03ce..992980ea98046 100644 > --- a/fs/ocfs2/inode.c > +++ b/fs/ocfs2/inode.c > @@ -72,6 +72,16 @@ static bool ocfs2_valid_inode_mode(umode_t mode) > return fs_umode_to_ftype(mode) != FT_UNKNOWN; > } > > +static bool ocfs2_dinode_has_unexpected_rdev(struct ocfs2_dinode *di) > +{ > + umode_t mode = le16_to_cpu(di->i_mode); > + > + if (le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL) > + return false; > + > + return !S_ISCHR(mode) && !S_ISBLK(mode) && di->id1.dev1.i_rdev != 0; > +} > + > void ocfs2_set_inode_flags(struct inode *inode) > { > unsigned int flags = OCFS2_I(inode)->ip_attr; > @@ -1518,6 +1528,41 @@ int ocfs2_validate_inode_block(struct super_block *sb, > goto bail; > } > > + /* > + * id1.dev1.i_rdev is the device-number arm of the id1 union and > + * is only meaningful for character and block device inodes. For > + * any other regular user-visible file type the on-disk value > + * must be zero. ocfs2_populate_inode() currently runs > + * > + * inode->i_rdev = huge_decode_dev(le64_to_cpu(fe->id1.dev1.i_rdev)); > + * > + * unconditionally, before the S_IFMT switch decides whether the > + * inode is a special file. As a result, an i_rdev value present > + * on a non-device inode is silently published into the in-core > + * inode; a subsequent forced re-read or in-core mode mutation > + * (cluster peer with raw write access to the shared LUN, > + * on-disk corruption, or a separately forged dinode) can then > + * expose the attacker-controlled device number to > + * init_special_inode() without ever showing an unusual i_mode > + * at validation time. > + * > + * System inodes (OCFS2_SYSTEM_FL) legitimately use the bitmap1 > + * and journal1 arms of the same union (allocator i_used / > + * i_total counters and the journal ij_flags / > + * ij_recovery_generation pair); those bytes are not an i_rdev > + * and must not be checked here. Restrict the cross-check to > + * non-system inodes, which is the full attacker-controllable > + * surface. > + */ > + if (ocfs2_dinode_has_unexpected_rdev(di)) { > + rc = ocfs2_error(sb, > + "Invalid dinode #%llu: non-device mode 0%o with i_rdev %llu\n", > + (unsigned long long)bh->b_blocknr, > + le16_to_cpu(di->i_mode), > + (unsigned long long)le64_to_cpu(di->id1.dev1.i_rdev)); > + goto bail; > + } > + > if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) { > struct ocfs2_inline_data *data = &di->id2.i_data; > > @@ -1657,6 +1702,16 @@ static int ocfs2_filecheck_validate_inode_block(struct super_block *sb, > (unsigned long long)bh->b_blocknr, > le16_to_cpu(di->i_mode)); > rc = -OCFS2_FILECHECK_ERR_INVALIDINO; > + goto bail; > + } > + > + if (ocfs2_dinode_has_unexpected_rdev(di)) { > + mlog(ML_ERROR, > + "Filecheck: invalid dinode #%llu: non-device mode 0%o with i_rdev %llu\n", > + (unsigned long long)bh->b_blocknr, > + le16_to_cpu(di->i_mode), > + (unsigned long long)le64_to_cpu(di->id1.dev1.i_rdev)); > + rc = -OCFS2_FILECHECK_ERR_INVALIDINO; > } > > bail: