FAILED: patch "[PATCH] btrfs: correctly validate compression type" failed to apply to 5.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From aa53e3bfac7205fb3a8815ac1c937fd6ed01b41e Mon Sep 17 00:00:00 2001
From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type
Nikolay reported the following KASAN splat when running btrfs/048:
[ 1843.470920] ================================================================== [ 1843.471971] BUG: KASAN: slab-out-of-bounds in strncmp+0x66/0xb0 [ 1843.472775] Read of size 1 at addr ffff888111e369e2 by task btrfs/3979
[ 1843.473904] CPU: 3 PID: 3979 Comm: btrfs Not tainted 5.2.0-rc3-default #536 [ 1843.475009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 1843.476322] Call Trace: [ 1843.476674] dump_stack+0x7c/0xbb [ 1843.477132] ? strncmp+0x66/0xb0 [ 1843.477587] print_address_description+0x114/0x320 [ 1843.478256] ? strncmp+0x66/0xb0 [ 1843.478740] ? strncmp+0x66/0xb0 [ 1843.479185] __kasan_report+0x14e/0x192 [ 1843.479759] ? strncmp+0x66/0xb0 [ 1843.480209] kasan_report+0xe/0x20 [ 1843.480679] strncmp+0x66/0xb0 [ 1843.481105] prop_compression_validate+0x24/0x70 [ 1843.481798] btrfs_xattr_handler_set_prop+0x65/0x160 [ 1843.482509] __vfs_setxattr+0x71/0x90 [ 1843.483012] __vfs_setxattr_noperm+0x84/0x130 [ 1843.483606] vfs_setxattr+0xac/0xb0 [ 1843.484085] setxattr+0x18c/0x230 [ 1843.484546] ? vfs_setxattr+0xb0/0xb0 [ 1843.485048] ? __mod_node_page_state+0x1f/0xa0 [ 1843.485672] ? _raw_spin_unlock+0x24/0x40 [ 1843.486233] ? __handle_mm_fault+0x988/0x1290 [ 1843.486823] ? lock_acquire+0xb4/0x1e0 [ 1843.487330] ? lock_acquire+0xb4/0x1e0 [ 1843.487842] ? mnt_want_write_file+0x3c/0x80 [ 1843.488442] ? debug_lockdep_rcu_enabled+0x22/0x40 [ 1843.489089] ? rcu_sync_lockdep_assert+0xe/0x70 [ 1843.489707] ? __sb_start_write+0x158/0x200 [ 1843.490278] ? mnt_want_write_file+0x3c/0x80 [ 1843.490855] ? __mnt_want_write+0x98/0xe0 [ 1843.491397] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.492201] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1843.493201] do_syscall_64+0x6c/0x230 [ 1843.493988] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1843.495041] RIP: 0033:0x7fa7a8a7707a [ 1843.495819] Code: 48 8b 0d 21 de 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ee dd 2b 00 f7 d8 64 89 01 48 [ 1843.499203] RSP: 002b:00007ffcb73bca38 EFLAGS: 00000202 ORIG_RAX: 00000000000000be [ 1843.500210] RAX: ffffffffffffffda RBX: 00007ffcb73bda9d RCX: 00007fa7a8a7707a [ 1843.501170] RDX: 00007ffcb73bda9d RSI: 00000000006dc050 RDI: 0000000000000003 [ 1843.502152] RBP: 00000000006dc050 R08: 0000000000000000 R09: 0000000000000000 [ 1843.503109] R10: 0000000000000002 R11: 0000000000000202 R12: 00007ffcb73bda91 [ 1843.504055] R13: 0000000000000003 R14: 00007ffcb73bda82 R15: ffffffffffffffff
[ 1843.505268] Allocated by task 3979: [ 1843.505771] save_stack+0x19/0x80 [ 1843.506211] __kasan_kmalloc.constprop.5+0xa0/0xd0 [ 1843.506836] setxattr+0xeb/0x230 [ 1843.507264] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.507886] do_syscall_64+0x6c/0x230 [ 1843.508429] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1843.509558] Freed by task 0: [ 1843.510188] (stack is not available)
[ 1843.511309] The buggy address belongs to the object at ffff888111e369e0
which belongs to the cache kmalloc-8 of size 8
[ 1843.514095] The buggy address is located 2 bytes inside of
8-byte region [ffff888111e369e0, ffff888111e369e8)
[ 1843.516524] The buggy address belongs to the page:
[ 1843.517561] page:ffff88813f478d80 refcount:1 mapcount:0 mapping:ffff88811940c300 index:0xffff888111e373b8 compound_mapcount: 0
[ 1843.519993] flags: 0x4404000010200(slab|head)
[ 1843.520951] raw: 0004404000010200 ffff88813f48b008 ffff888119403d50 ffff88811940c300
[ 1843.522616] raw: ffff888111e373b8 000000000016000f 00000001ffffffff 0000000000000000
[ 1843.524281] page dumped because: kasan: bad access detected[ 1843.525936] Memory state around the buggy address: [ 1843.526975] ffff888111e36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.528479] ffff888111e36900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.530138] >ffff888111e36980: fc fc fc fc fc fc fc fc fc fc fc fc 02 fc fc fc [ 1843.531877] ^ [ 1843.533287] ffff888111e36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.534874] ffff888111e36a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.536468] ==================================================================
This is caused by supplying a too short compression value ('lz') in the test-case and comparing it to 'lzo' with strncmp() and a length of 3. strncmp() read past the 'lz' when looking for the 'o' and thus caused an out-of-bounds read.
Introduce a new check 'btrfs_compress_is_valid_type()' which not only checks the user-supplied value against known compression types, but also employs checks for too short values.
fs/btrfs/compression.c +16 -0
@@ -43,6 +43,22 @@ const char* btrfs_compress_type2str(enum btrfs_compression_type type)return NULL ; } +bool btrfs_compress_is_valid_type (const char *str,size_t len) +{ +int i; + +for (i =1 ; i <ARRAY_SIZE (btrfs_compress_types); i++) { +size_t comp_len =strlen (btrfs_compress_types[i]); + +if (len < comp_len) +continue ; + +if (!strncmp (btrfs_compress_types[i], str, comp_len)) +return true; + } +return false; +} +static int btrfs_decompress_bio (struct compressed_bio *cb); static inline int compressed_bio_size(struct btrfs_fs_info *fs_info,
fs/btrfs/compression.h +1 -0
@@ -173,6 +173,7 @@ extern const struct btrfs_compress_op btrfs_lzo_compress;extern const struct btrfs_compress_op btrfs_zstd_compress;const char *btrfs_compress_type2str (enum btrfs_compression_type type); +bool btrfs_compress_is_valid_type (const char *str,size_t len);int btrfs_compress_heuristic (struct inode *inode,u64 start,u64 end);
fs/btrfs/props.c +1 -5
@@ -257,11 +257,7 @@ static int prop_compression_validate(const char *value, size_t len)if (!value)return 0 ; -if (!strncmp ("lzo" , value,3 )) -return 0 ; -else if (!strncmp ("zlib" , value,4 )) -return 0 ; -else if (!strncmp ("zstd" , value,4 )) +if (btrfs_compress_is_valid_type (value, len))return 0 ;return -EINVAL ;
Hi Greg,
please try the following:
From 9afa2d46ecb511259130eb51b4ab1feb1055d961 Mon Sep 17 00:00:00 2001
From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type
(commit aa53e3bfac7205fb3a8815ac1c937fd6ed01b41e upstream)
Nikolay reported the following KASAN splat when running btrfs/048:
[ 1843.470920] ================================================================== [ 1843.471971] BUG: KASAN: slab-out-of-bounds in strncmp+0x66/0xb0 [ 1843.472775] Read of size 1 at addr ffff888111e369e2 by task btrfs/3979
[ 1843.473904] CPU: 3 PID: 3979 Comm: btrfs Not tainted 5.2.0-rc3-default #536 [ 1843.475009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 1843.476322] Call Trace: [ 1843.476674] dump_stack+0x7c/0xbb [ 1843.477132] ? strncmp+0x66/0xb0 [ 1843.477587] print_address_description+0x114/0x320 [ 1843.478256] ? strncmp+0x66/0xb0 [ 1843.478740] ? strncmp+0x66/0xb0 [ 1843.479185] __kasan_report+0x14e/0x192 [ 1843.479759] ? strncmp+0x66/0xb0 [ 1843.480209] kasan_report+0xe/0x20 [ 1843.480679] strncmp+0x66/0xb0 [ 1843.481105] prop_compression_validate+0x24/0x70 [ 1843.481798] btrfs_xattr_handler_set_prop+0x65/0x160 [ 1843.482509] __vfs_setxattr+0x71/0x90 [ 1843.483012] __vfs_setxattr_noperm+0x84/0x130 [ 1843.483606] vfs_setxattr+0xac/0xb0 [ 1843.484085] setxattr+0x18c/0x230 [ 1843.484546] ? vfs_setxattr+0xb0/0xb0 [ 1843.485048] ? __mod_node_page_state+0x1f/0xa0 [ 1843.485672] ? _raw_spin_unlock+0x24/0x40 [ 1843.486233] ? __handle_mm_fault+0x988/0x1290 [ 1843.486823] ? lock_acquire+0xb4/0x1e0 [ 1843.487330] ? lock_acquire+0xb4/0x1e0 [ 1843.487842] ? mnt_want_write_file+0x3c/0x80 [ 1843.488442] ? debug_lockdep_rcu_enabled+0x22/0x40 [ 1843.489089] ? rcu_sync_lockdep_assert+0xe/0x70 [ 1843.489707] ? __sb_start_write+0x158/0x200 [ 1843.490278] ? mnt_want_write_file+0x3c/0x80 [ 1843.490855] ? __mnt_want_write+0x98/0xe0 [ 1843.491397] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.492201] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1843.493201] do_syscall_64+0x6c/0x230 [ 1843.493988] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1843.495041] RIP: 0033:0x7fa7a8a7707a [ 1843.495819] Code: 48 8b 0d 21 de 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ee dd 2b 00 f7 d8 64 89 01 48 [ 1843.499203] RSP: 002b:00007ffcb73bca38 EFLAGS: 00000202 ORIG_RAX: 00000000000000be [ 1843.500210] RAX: ffffffffffffffda RBX: 00007ffcb73bda9d RCX: 00007fa7a8a7707a [ 1843.501170] RDX: 00007ffcb73bda9d RSI: 00000000006dc050 RDI: 0000000000000003 [ 1843.502152] RBP: 00000000006dc050 R08: 0000000000000000 R09: 0000000000000000 [ 1843.503109] R10: 0000000000000002 R11: 0000000000000202 R12: 00007ffcb73bda91 [ 1843.504055] R13: 0000000000000003 R14: 00007ffcb73bda82 R15: ffffffffffffffff
[ 1843.505268] Allocated by task 3979: [ 1843.505771] save_stack+0x19/0x80 [ 1843.506211] __kasan_kmalloc.constprop.5+0xa0/0xd0 [ 1843.506836] setxattr+0xeb/0x230 [ 1843.507264] __x64_sys_fsetxattr+0xba/0xe0 [ 1843.507886] do_syscall_64+0x6c/0x230 [ 1843.508429] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1843.509558] Freed by task 0: [ 1843.510188] (stack is not available)
[ 1843.511309] The buggy address belongs to the object at ffff888111e369e0
which belongs to the cache kmalloc-8 of size 8
[ 1843.514095] The buggy address is located 2 bytes inside of
8-byte region [ffff888111e369e0, ffff888111e369e8)
[ 1843.516524] The buggy address belongs to the page:
[ 1843.517561] page:ffff88813f478d80 refcount:1 mapcount:0 mapping:ffff88811940c300 index:0xffff888111e373b8 compound_mapcount: 0
[ 1843.519993] flags: 0x4404000010200(slab|head)
[ 1843.520951] raw: 0004404000010200 ffff88813f48b008 ffff888119403d50 ffff88811940c300
[ 1843.522616] raw: ffff888111e373b8 000000000016000f 00000001ffffffff 0000000000000000
[ 1843.524281] page dumped because: kasan: bad access detected[ 1843.525936] Memory state around the buggy address: [ 1843.526975] ffff888111e36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.528479] ffff888111e36900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.530138] >ffff888111e36980: fc fc fc fc fc fc fc fc fc fc fc fc 02 fc fc fc [ 1843.531877] ^ [ 1843.533287] ffff888111e36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.534874] ffff888111e36a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1843.536468] ==================================================================
This is caused by supplying a too short compression value ('lz') in the test-case and comparing it to 'lzo' with strncmp() and a length of 3. strncmp() read past the 'lz' when looking for the 'o' and thus caused an out-of-bounds read.
Introduce a new check 'btrfs_compress_is_valid_type()' which not only checks the user-supplied value against known compression types, but also employs checks for too short values.
--- fs/btrfs/compression.c | 16 ++++++++++++++++ fs/btrfs/compression.h | 1 + fs/btrfs/props.c | 6 +----- 3 files changed, 18 insertions(+), 5 deletions(-)
fs/btrfs/compression.c +16 -0
@@ -42,6 +42,22 @@ const char* btrfs_compress_type2str(enum btrfs_compression_type type)return NULL ; } +bool btrfs_compress_is_valid_type (const char *str,size_t len) +{ +int i; + +for (i =1 ; i <ARRAY_SIZE (btrfs_compress_types); i++) { +size_t comp_len =strlen (btrfs_compress_types[i]); + +if (len < comp_len) +continue ; + +if (!strncmp (btrfs_compress_types[i], str, comp_len)) +return true; + } +return false; +} +static int btrfs_decompress_bio (struct compressed_bio *cb); static inline int compressed_bio_size(struct btrfs_fs_info *fs_info,
fs/btrfs/compression.h +1 -0
@@ -173,6 +173,7 @@ extern const struct btrfs_compress_op btrfs_lzo_compress;extern const struct btrfs_compress_op btrfs_zstd_compress;const char *btrfs_compress_type2str (enum btrfs_compression_type type); +bool btrfs_compress_is_valid_type (const char *str,size_t len);int btrfs_compress_heuristic (struct inode *inode,u64 start,u64 end);
fs/btrfs/props.c +1 -5
@@ -366,11 +366,7 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,static int prop_compression_validate (const char *value,size_t len) { -if (!strncmp ("lzo" , value,3 )) -return 0 ; -else if (!strncmp ("zlib" , value,4 )) -return 0 ; -else if (!strncmp ("zstd" , value,4 )) +if (btrfs_compression_is_valid_type (value, len))return 0 ;return -EINVAL ;
Signature · 9 lines
2.16.4 -- Johannes Thumshirn SUSE Labs Filesystems [email protected] +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg) Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
Greg KH
maintainerQuoted 10 lines · Johannes Thumshirn
Hi Greg,
please try the following:
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)
Worked for 5.1.y and 4.19.y, but not for the older ones.
thanks,
greg k-h
Quoted 5 lines · Greg KH
Quoted 4 lines · Johannes Thumshirn
Hi Greg,
please try the following:
Quoted 8 lines
Quoted 6 lines
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)Worked for 5.1.y and 4.19.y, but not for the older ones.
But 4.19 lacks the buggy commit, doesn't it?
Signature · 6 lines
Johannes Thumshirn SUSE Labs Filesystems [email protected] +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg) Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
Greg KH
maintainerQuoted 11 lines · Johannes Thumshirn
Quoted 10 lines · Greg KH
Quoted 9 lines · Johannes Thumshirn
Hi Greg,
please try the following:
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type
Quoted 5 lines
Quoted 3 lines
Quoted 1 line
(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)Worked for 5.1.y and 4.19.y, but not for the older ones.
But 4.19 lacks the buggy commit, doesn't it?
272e5326c783 ("btrfs: prop: fix vanished compression property after failed set") was originally in the 5.1 release, but it was backported to the 4.14.112 and 4.19.35 releases as well because it had a cc: stable tag in it.
thanks.
greg k-h
Quoted 14 lines · Greg KH
Quoted 13 lines · Johannes Thumshirn
Quoted 12 lines · Greg KH
Quoted 10 lines · Johannes Thumshirn
Hi Greg,
please try the following:
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)
Quoted 8 lines
Quoted 3 lines
Quoted 1 line
Worked for 5.1.y and 4.19.y, but not for the older ones.
But 4.19 lacks the buggy commit, doesn't it?
272e5326c783("btrfs: prop: fix vanished compression property after failed set") was originally in the 5.1 release, but it was backported to the 4.14.112 and 4.19.35 releases as well because it had a cc: stable tag in it.
Ah OK, thanks for clarification.
Byte,
Johannes
Signature · 6 lines
Johannes Thumshirn SUSE Labs Filesystems [email protected] +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg) Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
Den 23-07-2019 kl. 15:28, skrev Greg KH:
Quoted 5 lines · Johannes Thumshirn
Quoted 4 lines
Hi Greg,
please try the following:
Quoted 9 lines
Quoted 6 lines
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)Worked for 5.1.y and 4.19.y, but not for the older ones.
It applies to 5.1 but it does not build:
+ /usr/bin/make -O -j12 ARCH=x86_64 -s allfs/btrfs/props.c: In function 'prop_compression_validate':fs/btrfs/props.c:369:6: error: implicit declaration of function 'btrfs_compression_is_valid_type'; did you mean 'btrfs_compress_is_valid_type'? [-Werror=implicit-function-declaration]
if (btrfs_compression_is_valid_type(value, len))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
btrfs_compress_is_valid_typecc1: some warnings being treated as errors
--
Thomas
Greg KH
maintainerQuoted 24 lines · Thomas Backlund
Den 23-07-2019 kl. 15:28, skrev Greg KH:
Quoted 5 lines · Johannes Thumshirn
Quoted 4 lines
Hi Greg,
please try the following:
Quoted 9 lines
Quoted 6 lines
Quoted 1 line
From
9afa2d46ecb511259130eb51b4ab1feb1055d961Mon Sep 17 00:00:00 2001From: Johannes Thumshirn <[email protected]>
Date: Thu, 6 Jun 2019 12:07:15 +0200
Subject: [PATCH] btrfs: correctly validate compression type(commit
aa53e3bfac7205fb3a8815ac1c937fd6ed01b41eupstream)Worked for 5.1.y and 4.19.y, but not for the older ones.
It applies to 5.1 but it does not build:
+
/usr/bin/make-O -j12 ARCH=x86_64 -s allfs/btrfs/props.c: In function 'prop_compression_validate':fs/btrfs/props.c:369:6: error: implicit declaration of function 'btrfs_compression_is_valid_type'; did you mean 'btrfs_compress_is_valid_type'? [-Werror=implicit-function-declaration]
if (btrfs_compression_is_valid_type(value, len))
Quoted 3 lines
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ btrfs_compress_is_valid_typecc1: some warnings being treated as errors
Yes, now dropped from 5.1 and 4.19 trees.
thanks,
greg k-h