[PATCH 0/4] ocfs2: validate suballoc slot and bit of metadata blocks

[Joseph Qi]

ocfs2 metadata validators trust the on-disk suballoc slot (and the
dinode suballoc bit) without checking them against the mounted
filesystem's slot range.  A corrupted image can carry
OCFS2_INVALID_SLOT or another out-of-range value; when the
corresponding inode, extent block, xattr block, or dir index root is
later freed, the unvalidated slot/bit is passed to
ocfs2_get_system_file_inode() or _ocfs2_free_suballoc_bits() and hits
BUG_ON() or indexes local_system_inodes[] out of bounds.

Mounting ocfs2 requires privilege (ocfs2 cannot be mounted from a
user namespace), so this needs a privileged mount of a crafted or
corrupted image -- e.g. an administrator mounting untrusted media or a
disk image supplied to a virtual machine.  Once such an image is
mounted, an unprivileged user who can delete the corrupted object
triggers the crash.

This series rejects such values at read time, in the existing
validators, so corrupted objects fail with -EROFS (and a read-only
remount) instead of crashing:

  patch 1 restricts OCFS2_INVALID_SLOT dinodes to system inodes,
        completing fe7a283b3916 ("ocfs2: add suballoc slot check in
        ocfs2_validate_inode_block()");
  patch 2 rejects oversized dinode suballoc bits;
  patch 3 validates the suballoc slot of xattr and dir index blocks;
  patch 4 validates the suballoc slot of extent blocks.

All checks match what the kernel itself writes (always a valid slot
from meta_ac->ac_alloc_slot) and what mkfs.ocfs2/libocfs2 write
(system inodes carry OCFS2_INVALID_SLOT with OCFS2_SYSTEM_FL, extent
blocks carry slot 0), so legitimate filesystems are unaffected.

Tested with negative corruption testing under QEMU: for each new
check a test image was generated with the field overwritten by an
out-of-range value; with the series applied the access fails cleanly
with -EROFS and the filesystem remounts read-only instead of hitting
BUG_ON().

Joseph Qi (4):
  ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes
  ocfs2: validate suballoc bit during inode read
  ocfs2: validate suballoc slot of xattr and dir index blocks
  ocfs2: validate suballoc slot of extent blocks

 fs/ocfs2/alloc.c | 14 ++++++++++++++
 fs/ocfs2/dir.c   | 14 ++++++++++++++
 fs/ocfs2/inode.c | 33 +++++++++++++++++++++++++++++++--
 fs/ocfs2/xattr.c | 13 +++++++++++++
 4 files changed, 72 insertions(+), 2 deletions(-)

-- 
2.39.3