[f2fs-dev] [PATCH 3/3] fsck.f2fs: sanity check quota file size in v2_init_io

In v2_init_io(), quota file size is not bounded. A corrupted or crafted
quota inode with a large i_size can set dqi_blocks to a huge value
(e.g. 0xFFFFFFFC).

When scanning dquots in qtree_scan_dquots(), computing the bitmap size
as (info->dqi_blocks + 7) >> 3 causes an unsigned 32-bit integer wrap to 0,
allocating a 0-byte buffer via malloc(0). Later, report_block() performs
out-of-bounds bit-setting writes past the heap buffer.

This patch fixes the issue by:
1. Porting the e2fsprogs check (CVE-2019-5094) into v2_init_io() to cap
   quota file size at 2GB (1ULL << 31).
2. Casting info->dqi_blocks to size_t when calculating bitmap allocation
   size in qtree_scan_dquots() as defense-in-depth.

Signed-off-by: Chao Yu <[email protected]>
---
 fsck/quotaio_tree.c | 2 +-
 fsck/quotaio_v2.c   | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/fsck/quotaio_tree.c b/fsck/quotaio_tree.c
index 40521c5..60cec7d 100644
--- a/fsck/quotaio_tree.c
+++ b/fsck/quotaio_tree.c
@@ -667,7 +667,7 @@ int qtree_scan_dquots(struct quota_handle *h,
 		return -1;
 
 	dquot->dq_h = h;
-	if (quota_get_memzero((info->dqi_blocks + 7) >> 3, &bitmap))
+	if (quota_get_memzero(((size_t)info->dqi_blocks + 7) >> 3, &bitmap))
 		goto out;
 	if (report_tree(dquot, QT_TREEOFF, 0, bitmap, &entries, process_dquot,
 				data))
diff --git a/fsck/quotaio_v2.c b/fsck/quotaio_v2.c
index e19f303..50daf26 100644
--- a/fsck/quotaio_v2.c
+++ b/fsck/quotaio_v2.c
@@ -206,6 +206,12 @@ static int v2_init_io(struct quota_handle *h, enum quota_type qtype)
 		f2fs_filesize_update(qf->sbi, qf->ino, filesize);
 	}
 
+	if (filesize > (1ULL << 31)) {
+		log_err("Quota inode %u corrupted: file size %" PRIu64
+			" too large", h->qh_qf.ino, filesize);
+		return -1;
+	}
+
 	if ((info->dqi_qtree.dqi_blocks >
 			(filesize + QT_BLKSIZE - 1) >> QT_BLKSIZE_BITS)) {
 		log_err("Quota inode %u corrupted: file size %" PRId64 "; "
-- 
2.49.0



_______________________________________________
Linux-f2fs-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel