[PATCH 2/3] affs: check affs_bread() return value in affs_truncate()

[Hui Peng]

The extension block walk at the end of affs_truncate() does not check
the result of affs_bread():

	while (ext_key) {
		ext_bh = affs_bread(sb, ext_key);
		size = AFFS_SB(sb)->s_hashsize;
		...
			affs_free_block(sb, be32_to_cpu(AFFS_BLOCK(sb, ext_bh, i)));
		affs_free_block(sb, ext_key);
		ext_key = be32_to_cpu(AFFS_TAIL(sb, ext_bh)->extension);

ext_key comes from the on-disk extension chain, and affs_bread() returns
NULL for any block outside [s_reserved, s_partition_size) as well as on
a read error. AFFS_BLOCK() and AFFS_TAIL() then dereference it, so a
crafted image with an out-of-range extension pointer gives a NULL
pointer dereference while truncating.

Every other affs_bread() caller in fs/affs/amigaffs.c already checks for
NULL; this loop is the outlier. Bail out of the walk on failure.

Breaking out rather than returning keeps the affs_free_prealloc() call
at the end of the function. The remaining extension blocks are leaked in
the on-disk bitmap, which is the correct trade-off against dereferencing
NULL - the image is already corrupt at that point, and the error is
reported.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
affs_validblock() was factored out of affs_bread() by commit d5de9fd594eb
("fs/affs: add validation block function") in v4.11, but the predicate it
replaced was inline in affs_bread() since the start of git history, so
the NULL return has always been possible here.

diff --git a/fs/affs/file.c b/fs/affs/file.c
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -971,6 +971,11 @@
 
 	while (ext_key) {
 		ext_bh = affs_bread(sb, ext_key);
+		if (!ext_bh) {
+			affs_error(sb, "truncate",
+				   "Cannot read extension block %u", ext_key);
+			break;
+		}
 		size = AFFS_SB(sb)->s_hashsize;
 		if (size > blkcnt - blk)
 			size = blkcnt - blk;
-- 
2.43.0