Re: [syzbot] fs/ntfs3: Do copy_to_user out of run_lock

From: syzbot
Date: Wed Jun 19 2024 - 02:52:39 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: fs/ntfs3: Do copy_to_user out of run_lock
Author: almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx

#syz test

--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -1898,6 +1898,47 @@ enum REPARSE_SIGN ni_parse_reparse(struct
ntfs_inode *ni, struct ATTRIB *attr,
     return REPARSE_LINK;
 }

+/*
+ * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent
+ * but it accepts kernel address for fi_extents_start
+ */
+static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo,
+                     u64 logical, u64 phys, u64 len, u32 flags)
+{
+    struct fiemap_extent extent;
+    struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+
+    /* only count the extents */
+    if (fieinfo->fi_extents_max == 0) {
+        fieinfo->fi_extents_mapped++;
+        return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0;
+    }
+
+    if (fieinfo->fi_extents_mapped >= fieinfo->fi_extents_max)
+        return 1;
+
+    if (flags & FIEMAP_EXTENT_DELALLOC)
+        flags |= FIEMAP_EXTENT_UNKNOWN;
+    if (flags & FIEMAP_EXTENT_DATA_ENCRYPTED)
+        flags |= FIEMAP_EXTENT_ENCODED;
+    if (flags & (FIEMAP_EXTENT_DATA_TAIL | FIEMAP_EXTENT_DATA_INLINE))
+        flags |= FIEMAP_EXTENT_NOT_ALIGNED;
+
+    memset(&extent, 0, sizeof(extent));
+    extent.fe_logical = logical;
+    extent.fe_physical = phys;
+    extent.fe_length = len;
+    extent.fe_flags = flags;
+
+    dest += fieinfo->fi_extents_mapped;
+    memcpy(dest, &extent, sizeof(extent));
+
+    fieinfo->fi_extents_mapped++;
+    if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
+        return 1;
+    return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0;
+}
+
 /*
  * ni_fiemap - Helper for file_fiemap().
  *
@@ -1908,6 +1949,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct
fiemap_extent_info *fieinfo,
           __u64 vbo, __u64 len)
 {
     int err = 0;
+    struct fiemap_extent __user *fe_u = fieinfo->fi_extents_start;
+    struct fiemap_extent *fe_k = NULL;
     struct ntfs_sb_info *sbi = ni->mi.sbi;
     u8 cluster_bits = sbi->cluster_bits;
     struct runs_tree *run;
@@ -1955,6 +1998,18 @@ int ni_fiemap(struct ntfs_inode *ni, struct
fiemap_extent_info *fieinfo,
         goto out;
     }

+    /*
+     * To avoid lock problems replace pointer to user memory by pointer
to kernel memory.
+     */
+    fe_k = kmalloc_array(fieinfo->fi_extents_max,
+                 sizeof(struct fiemap_extent),
+                 GFP_NOFS | __GFP_ZERO);
+    if (!fe_k) {
+        err = -ENOMEM;
+        goto out;
+    }
+    fieinfo->fi_extents_start = fe_k;
+
     end = vbo + len;
     alloc_size = le64_to_cpu(attr->nres.alloc_size);
     if (end > alloc_size)
@@ -2043,8 +2098,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct
fiemap_extent_info *fieinfo,
             if (vbo + dlen >= end)
                 flags |= FIEMAP_EXTENT_LAST;

-            err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen,
-                              flags);
+            err = fiemap_fill_next_extent_k(fieinfo, vbo, lbo, dlen,
+                            flags);
+
             if (err < 0)
                 break;
             if (err == 1) {
@@ -2064,7 +2120,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct
fiemap_extent_info *fieinfo,
         if (vbo + bytes >= end)
             flags |= FIEMAP_EXTENT_LAST;

-        err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags);
+        err = fiemap_fill_next_extent_k(fieinfo, vbo, lbo, bytes,
+                        flags);
         if (err < 0)
             break;
         if (err == 1) {
@@ -2077,7 +2134,19 @@ int ni_fiemap(struct ntfs_inode *ni, struct
fiemap_extent_info *fieinfo,

     up_read(run_lock);

+    /*
+     * Copy to user memory out of lock
+     */
+    if (copy_to_user(fe_u, fe_k,
+             fieinfo->fi_extents_max *
+                 sizeof(struct fiemap_extent))) {
+        err = -EFAULT;
+    }
+
 out:
+    /* Restore original pointer. */
+    fieinfo->fi_extents_start = fe_u;
+    kfree(fe_k);
     return err;
 }