[PATCH] ext4: don't trust on-disk rec_len in dx_move_dirents()

[Adriano Cordova]

#syz test: upstream master
---
fs/ext4/namei.c | 38 ++++++++++++++++++++++++++++++--------
1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f..83e4564f9f44 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1840,30 +1840,46 @@ struct dentry *ext4_get_parent(struct dentry *child)

/*
* Move count entries from end of map between two memory locations.
- * Returns pointer to last entry moved.
+ * Returns pointer to last entry moved or an ERR_PTR on a corrupt entry.
*/
static struct ext4_dir_entry_2 *
dx_move_dirents(struct inode *dir, char *from, char *to,
struct dx_map_entry *map, int count,
unsigned blocksize)
{
+ char *to_start = to;
unsigned rec_len = 0;

while (count--) {
- struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)
- (from + (map->offs<<2));
+ unsigned int off = map->offs << 2;
+ struct ext4_dir_entry_2 *de;
+
+ /*
+ * The map is built from on-disk dirents, but a corrupted or
+ * concurrently reused leaf block can still make an entry point
+ * outside the block. Never dereference such an entry.
+ */
+ if (off > blocksize - sizeof(struct ext4_dir_entry_2))
+ return ERR_PTR(-EFSCORRUPTED);
+ de = (struct ext4_dir_entry_2 *)(from + off);
rec_len = ext4_dir_rec_len(de->name_len, dir);
+ if (off + rec_len > blocksize ||
+ to + rec_len > to_start + blocksize)
+ return ERR_PTR(-EFSCORRUPTED);

memcpy (to, de, rec_len);
((struct ext4_dir_entry_2 *) to)->rec_len =
ext4_rec_len_to_disk(rec_len, blocksize);

- /* wipe dir_entry excluding the rec_len field */
+ /*
+ * Wipe dir_entry excluding the rec_len field. Use the entry's
+ * own (minimal) length instead of the untrusted on-disk rec_len,
+ * which on a corrupt block decodes to an arbitrary huge value
+ * and turns this into an out-of-bounds memset().
+ */
de->inode = 0;
- memset(&de->name_len, 0, ext4_rec_len_from_disk(de->rec_len,
- blocksize) -
- offsetof(struct ext4_dir_entry_2,
- name_len));
+ memset(&de->name_len, 0, rec_len -
+ offsetof(struct ext4_dir_entry_2, name_len));

map++;
to += rec_len;
@@ -1992,6 +2008,12 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
/* Fancy dance to stay within two buffers */
de2 = dx_move_dirents(dir, data1, data2, map + split, count - split,
blocksize);
+ if (IS_ERR(de2)) {
+ ext4_error_inode_block(dir, (*bh)->b_blocknr, 0,
+ "bad indexed directory entry");
+ err = PTR_ERR(de2);
+ goto out;
+ }
de = dx_pack_dirents(dir, data1, blocksize);
de->rec_len = ext4_rec_len_to_disk(data1 + (blocksize - csum_size) -
(char *) de,
--
2.51.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+09bec7...@syzkaller.appspotmail.com
Tested-by: syzbot+09bec7...@syzkaller.appspotmail.com

Tested on:

commit: d24e8ac7 Merge tag 'net-7.3-rc6' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165673f5580000
kernel config: https://syzkaller.appspot.com/x/.config?x=718e346eb0b8f38
dashboard link: https://syzkaller.appspot.com/bug?extid=09bec78ee77613a3efdd
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=113953f5580000

Note: testing is done by a robot and is best-effort only.

[Adriano Cordova]

#syz test: upstream master
syzbot reported an out-of-bounds write from do_split() while a directory
is converted to an indexed one:

BUG: KASAN: slab-out-of-bounds in dx_move_dirents [inline]
BUG: KASAN: slab-out-of-bounds in do_split+0xf9c/0x1de0
Write of size 90458

dx_move_dirents() wipes the source entry using its on-disk rec_len.
That field can't be trusted: on a corrupt block it may be garbage
(0x6161 here) and ext4_rec_len_from_disk() turns it into a huge value,
so the memset() runs far past the block. The entry is already copied
using its own real length, so use that length for the wipe as well.

Closes: https://syzkaller.appspot.com/bug?extid=09bec78ee77613a3efdd
---
fs/ext4/namei.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f..71e9e7c9a7fd 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1860,10 +1860,8 @@ dx_move_dirents(struct inode *dir, char *from, char *to,

/* wipe dir_entry excluding the rec_len field */

de->inode = 0;
- memset(&de->name_len, 0, ext4_rec_len_from_disk(de->rec_len,
- blocksize) -
- offsetof(struct ext4_dir_entry_2,
- name_len));
+ memset(&de->name_len, 0, rec_len -
+ offsetof(struct ext4_dir_entry_2, name_len));

map++;
to += rec_len;

--
2.51.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+09bec7...@syzkaller.appspotmail.com
Tested-by: syzbot+09bec7...@syzkaller.appspotmail.com

Tested on:

commit: d24e8ac7 Merge tag 'net-7.3-rc6' of git://git.kernel.o..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=17862035580000

kernel config: https://syzkaller.appspot.com/x/.config?x=718e346eb0b8f38
dashboard link: https://syzkaller.appspot.com/bug?extid=09bec78ee77613a3efdd
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=10b756c9580000