fs-verity: fix signed integer overflow with i_size near S64_MAX
Subsystems (4)
Eric Biggers
maintainerPATCH 1/1 fs-verity: fix signed integer overflow with i_size near S64_MAX
From: Eric Biggers <[email protected]>
If the file size is almost S64_MAX, the calculated number of Merkle tree levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to fail. This is unintentional, since as the comment above the definition of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.)
The bug is actually that when the number of blocks in the first level is calculated from i_size, there is a signed integer overflow due to i_size being signed. Fix this by treating i_size is unsigned.
This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).
This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to S64_MAX bytes.
--- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/verity/enable.c +1 -1
@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file *filp,* (level 0) and ascending to the root node (level 'num_levels - 1'). * Then at the end (level 'num_levels'), calculate the root hash. */ - blocks = (inode->i_size + params->block_size -1 ) >> + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> params->log_blocksize;for (level =0 ; level <= params->num_levels; level++) { err = build_merkle_tree_level(filp, level, blocks, params,
fs/verity/open.c +1 -1
@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params,*/ /* Compute number of levels and the number of blocks in each level */ - blocks = (inode->i_size + params->block_size -1 ) >> log_blocksize; + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> log_blocksize;pr_debug ("Data is %lld bytes (%llu blocks)\n" , inode->i_size, blocks);while (blocks >1 ) {if (params->num_levels >=FS_VERITY_MAX_LEVELS ) {
Signature · 1 line
2.33.0
Quoted 15 lines · Eric Biggers
From: Eric Biggers <[email protected]>
If the file size is almost
S64_MAX, the calculated number of Merkle tree levels exceedsFS_VERITY_MAX_LEVELS, causingFS_IOC_ENABLE_VERITYto fail. This is unintentional, since as the comment above the definition ofFS_VERITY_MAX_LEVELSstates, it is enough for overU64_MAXbytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.)The bug is actually that when the number of blocks in the first level is calculated from
i_size, there is a signed integer overflow due toi_sizebeing signed. Fix this by treatingi_sizeis unsigned.This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).
Quoted 8 lines
This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to
S64_MAXbytes.Reported-by Boris Burkov <[email protected]>Fixes 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl")Fixes fd2d1acfcadf ("fs-verity: add the hook for file ->open()")Cc <[email protected]> # v5.4+Signed-off-by Eric Biggers <[email protected]>
Ah good catch! I'll update the test to not work around it.
Quoted 34 lines
--- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)fs/verity/enable.c +1
-1@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file *filp,* (level 0) and ascending to the root node (level 'num_levels - 1'). * Then at the end (level 'num_levels'), calculate the root hash. */ - blocks = (inode->i_size + params->block_size -1 ) >> + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> params->log_blocksize;for (level =0 ; level <= params->num_levels; level++) { err = build_merkle_tree_level(filp, level, blocks, params,fs/verity/open.c +1
-1@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params,*/ /* Compute number of levels and the number of blocks in each level */ - blocks = (inode->i_size + params->block_size -1 ) >> log_blocksize; + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> log_blocksize;pr_debug ("Data is %lld bytes (%llu blocks)\n" , inode->i_size, blocks);while (blocks >1 ) {if (params->num_levels >=FS_VERITY_MAX_LEVELS ) {Signature · 1 line
2.33.0