[PATCH 0/3] affs: fix out-of-bounds bitmap access on crafted images

[Hui Peng]

While fuzzing AFFS with KASAN I hit an out-of-bounds read roughly 8.45 MB
past sbi->s_bitmap, triggered by truncating a file on a crafted image.
Tracking it down turned up three separate problems, all dating back to
the start of git history.

The root cause is that affs_free_block() and affs_alloc_block() each
open code their own block range test, and both get it wrong in the same
two ways: neither rejects a block below s_reserved, so the subsequent
`block - s_reserved` underflows, and both use `> s_partition_size` where
the last valid block is s_partition_size - 1.

AFFS already has affs_validblock() expressing the correct range, and
affs_bread() and friends have gated on it since 2005 - so these two
functions were happily operating on blocks the rest of the filesystem
has always refused to touch. Patches 1 and 3 simply make them use it.
Patch 2 is unrelated except that I found it on the same path: the
extension block walk in affs_truncate() never checks affs_bread() for
NULL, which a crafted extension chain turns into a NULL dereference.

  1/3 is the one with the reproducer and the KASAN splat.
  2/3 is a straightforward missing NULL check.
  3/3 is the sibling of 1/3 with no reproducer - closer to hardening.

I kept them separate rather than folding 3/3 into 1/3 because the
reachability stories are quite different and I did not want the
unreproducible one to hold up the other. Equally happy to squash if you
would rather have one patch.

I also deliberately left out two extra defensive checks I had written
(a post-division `bmap >= s_bmap_count` test, and an early return when
sbi->s_bitmap is NULL); both are provably unreachable once 1/3 lands.
The reasoning is spelled out under the --- in 1/3.

Per Documentation/process/threat-model.rst these are regular bugs rather
than vulnerabilities, since mounting an image is privileged, so there is
no stable Cc and I have posted in the open.

Built with CONFIG_AFFS_FS=y, no new warnings; checkpatch clean.

Hui Peng (3):
  affs: reject out-of-range blocks in affs_free_block()
  affs: check affs_bread() return value in affs_truncate()
  affs: validate the allocation goal in affs_alloc_block()

 fs/affs/bitmap.c | 4 ++--
 fs/affs/file.c   | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.43.0