ext4: avoid cycles in directory h-tree

A maliciously corrupted filesystem can contain cycles in the h-tree
stored inside a directory. That can easily lead to the kernel corrupting
tree nodes that were already verified under its hands while doing a node
split and consequently accessing unallocated memory. Fix the problem by
verifying traversed block numbers are unique.

Cc: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 7286472e9558affd1955412f094b4d76387fce1e..47d0ca4c795b6ec761697d5560b1a77dfbfeb840 100644 (file)
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -777,12 +777,14 @@ static struct dx_frame *
 dx_probe(struct ext4_filename *fname, struct inode *dir,
         struct dx_hash_info *hinfo, struct dx_frame *frame_in)
 {
-       unsigned count, indirect;
+       unsigned count, indirect, level, i;
        struct dx_entry *at, *entries, *p, *q, *m;
        struct dx_root *root;
        struct dx_frame *frame = frame_in;
        struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR);
        u32 hash;
+       ext4_lblk_t block;
+       ext4_lblk_t blocks[EXT4_HTREE_LEVEL];
 
        memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0]));
        frame->bh = ext4_read_dirblock(dir, 0, INDEX);
@@ -854,6 +856,8 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
        }
 
        dxtrace(printk("Look up %x", hash));
+       level = 0;
+       blocks[0] = 0;
        while (1) {
                count = dx_get_count(entries);
                if (!count || count > dx_get_limit(entries)) {
@@ -882,15 +886,27 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
                               dx_get_block(at)));
                frame->entries = entries;
                frame->at = at;
-               if (!indirect--)
+
+               block = dx_get_block(at);
+               for (i = 0; i <= level; i++) {
+                       if (blocks[i] == block) {
+                               ext4_warning_inode(dir,
+                                       "dx entry: tree cycle block %u points back to block %u",
+                                       blocks[level], block);
+                               goto fail;
+                       }
+               }
+               if (++level > indirect)
                        return frame;
+               blocks[level] = block;
                frame++;
-               frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX);
+               frame->bh = ext4_read_dirblock(dir, block, INDEX);
                if (IS_ERR(frame->bh)) {
                        ret_err = (struct dx_frame *) frame->bh;
                        frame->bh = NULL;
                        goto fail;
                }
+
                entries = ((struct dx_node *) frame->bh->b_data)->entries;
 
                if (dx_get_limit(entries) != dx_node_limit(dir)) {