gfs2: Always check inode size of inline inodes

commit 5a64b01afc25a8add3336e5945a1edf36eca7147 upstream.

Check if the inode size of stuffed (inline) inodes is within the allowed
range when reading inodes from disk (gfs2_dinode_in()).  This prevents
us from on-disk corruption.

The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just
truncate inline data to the maximum allowed size don't actually make
sense, and they can be removed now as well.

Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
[pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with
the format used before upstream commit 2fc442816529 ("gfs2: Cosmetic
gfs2_dinode_{in,out} cleanup")]
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index c21383fab33b7f3490ebc3290048633fe82f4e0c..9dbe94c7d8e8915d99edb545de134da3047c4ad0 100644 (file)
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -456,8 +456,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
                return error;
 
        kaddr = kmap_atomic(page);
-       if (dsize > gfs2_max_stuffed_size(ip))
-               dsize = gfs2_max_stuffed_size(ip);
        memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
        memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
        kunmap_atomic(kaddr);

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 77a497a4b2368c1a93e6c7674ab2e5c946e2d6a4..b349ba328a0b8389d74e75f78c1820fe7729a623 100644 (file)
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -70,9 +70,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh,
                void *kaddr = kmap(page);
                u64 dsize = i_size_read(inode);
  
-               if (dsize > gfs2_max_stuffed_size(ip))
-                       dsize = gfs2_max_stuffed_size(ip);
-
                memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
                memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
                kunmap(page);

diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index d5b9274662db138e22ad1c060aa610524d231ded..69106a1545fadac98bcfdb97cd4b8423f2be4067 100644 (file)
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -411,6 +411,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
        ip->i_depth = (u8)depth;
        ip->i_entries = be32_to_cpu(str->di_entries);
 
+       if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip))
+               goto corrupt;
+
        if (S_ISREG(ip->i_inode.i_mode))
                gfs2_set_aops(&ip->i_inode);