[PATCH] freevxfs: fix off-page read on a crafted dirblock

[Baul Lee]

vxfs_readdir() and vxfs_find_entry() both advance the intra-page offset
pg_ofs by VXFS_DIRBLKOV(sbi, dbp) at each dirblock boundary and then
dereference

	de = (struct vxfs_direct *)(kaddr + pg_ofs);

without re-checking pg_ofs against PAGE_SIZE in between.  The enclosing
while (pg_ofs < PAGE_SIZE && pos < limit) test only gates loop
re-entry, not the deref that follows the addition in the same
iteration.

VXFS_DIRBLKOV() is 2 * d_nhash + 4, and d_nhash is an unvalidated
on-disk __fs16, so the overhead is attacker arithmetic of up to roughly
32 pages.  kaddr is page_address() of the single order-0 page-cache
page returned by vxfs_get_page(), so nothing else bounds the addition
and the de->d_reclen load lands off the mapped page.  Directory pages
are consumed unvalidated: vxfs_check_page() was never implemented, only
a commented-out call survives.

Both sites are reachable on any mounted crafted freevxfs image, the
vxfs_readdir() one from an unprivileged getdents64(2) and the
vxfs_find_entry() one from any path walk into the directory.  When
d_ino is non-zero vxfs_readdir() also feeds the off-page bytes to
dir_emit(), so they reach userspace.  KASAN reports a 2-byte
out-of-bounds read in vxfs_readdir().

Re-check pg_ofs against PAGE_SIZE right after the addition and before
the deref in both loops, restoring the invariant they already assume.
The added break leaves the page the same way the existing zero-d_reclen
break does.  Well-formed directories, whose overhead never pushes
pg_ofs past a single dirblock, are unaffected.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xxxxxxxx>

Fixes: 12495ea3ac47 ("freevxfs: refactor readdir and lookup code")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xxxxxxxx>
Reported-by: Baul Lee <baul.lee@xxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Baul Lee <baul.lee@xxxxxxxx>
---
 fs/freevxfs/vxfs_lookup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/freevxfs/vxfs_lookup.c b/fs/freevxfs/vxfs_lookup.c
index 138e08de976e..b068f93359fb 100644
--- a/fs/freevxfs/vxfs_lookup.c
+++ b/fs/freevxfs/vxfs_lookup.c
@@ -87,6 +87,8 @@ vxfs_find_entry(struct inode *ip, struct dentry *dp, struct page **ppp)
 
 				pos += overhead;
 				pg_ofs += overhead;
+				if (pg_ofs >= PAGE_SIZE)
+					break;
 			}
 			de = (struct vxfs_direct *)(kaddr + pg_ofs);
 
@@ -237,6 +239,8 @@ vxfs_readdir(struct file *fp, struct dir_context *ctx)
 
 				pos += overhead;
 				pg_ofs += overhead;
+				if (pg_ofs >= PAGE_SIZE)
+					break;
 			}
 			de = (struct vxfs_direct *)(kaddr + pg_ofs);
 
-- 
2.50.1 (Apple Git-155)