[PATCH] fs/freevxfs: reject immed inode larger than the inline area

[Marouane El Moufid]

vxfs_immed_read_folio() copies a full PAGE_SIZE from the 96-byte inline
immed area (vii_immed.vi_immed) without clamping to the inode size. An
"immed" inode whose on-disk size exceeds 96 bytes therefore causes an
out-of-bounds read of the vxfs_inode slab, and the bytes are returned to
userspace by read() (KASAN: slab-out-of-bounds, read of size 4096),
reachable from a mounted crafted VxFS image by read() of the file.

An immed inode stores its data inline and is always <= VXFS_NIMMED (96)
bytes; reject at iget time any immed inode that claims a larger size.

Signed-off-by: Marouane El Moufid <eun0us@xxxxxxxxxxx>
---
 fs/freevxfs/vxfs_inode.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/freevxfs/vxfs_inode.c b/fs/freevxfs/vxfs_inode.c
--- a/fs/freevxfs/vxfs_inode.c
+++ b/fs/freevxfs/vxfs_inode.c
@@ -268,6 +268,11 @@
 		return ERR_PTR(error);
 	}

+	if (VXFS_ISIMMED(vip) && ip->i_size > sizeof(vip->vii_immed.vi_immed)) {
+		iget_failed(ip);
+		return ERR_PTR(-EINVAL);
+	}
+
 	if (VXFS_ISIMMED(vip))
 		aops = &vxfs_immed_aops;
 	else