[PATCH] xfs: fix out-of-bounds cursor access from rtrmap level off-by-one

[Henry Martin]

m_rtrmap_maxlevels includes the inode root level, so a valid on-disk
bb_level is strictly less than m_rtrmap_maxlevels.  Both
xfs_rtrmapbt_verify() and xfs_iformat_rtrmap() compare with ">"
instead of ">=", letting a forged block with level == maxlevels pass
validation.  The cursor is then sized for maxlevels entries while
bc_nlevels is set to level + 1, so the generic btree code indexes one
element past bc_levels[] - an out-of-bounds read/write on the cursor
allocation.

xfs_rtrmapbt_mem_verify() in the same file (from commit
4a61f12eb1195 "xfs: create a shadow rmap btree during realtime rmap
repair") already uses ">=".

This vulnerability was discovered by Tencent CodeBuddy Security.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: fc6856c6ff086 ("xfs: introduce realtime rmap btree ondisk definitions")
Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
---
 fs/xfs/libxfs/xfs_rtrmap_btree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_rtrmap_btree.c b/fs/xfs/libxfs/xfs_rtrmap_btree.c
index a15e460a1ec7..6833c924a383 100644
--- a/fs/xfs/libxfs/xfs_rtrmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rtrmap_btree.c
@@ -256,7 +256,7 @@ xfs_rtrmapbt_verify(
 	if (fa)
 		return fa;
 	level = be16_to_cpu(block->bb_level);
-	if (level > mp->m_rtrmap_maxlevels)
+	if (level >= mp->m_rtrmap_maxlevels)
 		return __this_address;

 	return xfs_btree_fsblock_verify(bp, mp->m_rtrmap_mxr[level != 0]);
@@ -888,7 +888,7 @@ xfs_iformat_rtrmap(
 	numrecs = be16_to_cpu(dfp->bb_numrecs);
 	level = be16_to_cpu(dfp->bb_level);

-	if (level > mp->m_rtrmap_maxlevels ||
+	if (level >= mp->m_rtrmap_maxlevels ||
 	    xfs_rtrmap_droot_space_calc(level, numrecs) > dsize) {
 		xfs_inode_mark_sick(ip, XFS_SICK_INO_CORE);
 		return -EFSCORRUPTED;
--
2.43.7