[PATCH] ufs: validate the inode bitmap range

[Junrui Luo (ANT AI Security Lab)]

ufs_read_cylinder() caches cg_iusedoff without checking that the inode
bitmap fits in the loaded cylinder-group buffers. A malformed offset
or bitmap length can cause out-of-bounds accesses during inode
allocation and freeing.

Reject cylinder groups whose inode bitmap exceeds the loaded buffers.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Junrui Luo (ANT AI Security Lab) <luojunrui.ljr@xxxxxxxxxxxx>
---
 fs/ufs/cylinder.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/ufs/cylinder.c b/fs/ufs/cylinder.c
index b930ee1cf853..2b37359d7464 100644
--- a/fs/ufs/cylinder.c
+++ b/fs/ufs/cylinder.c
@@ -33,7 +33,7 @@ static bool ufs_read_cylinder(struct super_block *sb,
 	struct ufs_sb_private_info * uspi;
 	struct ufs_cg_private_info * ucpi;
 	struct ufs_cylinder_group * ucg;
-	unsigned i, j;
+	unsigned i, j, cgsize;
 
 	UFSD("ENTER, cgno %u, bitmap_nr %u\n", cgno, bitmap_nr);
 	uspi = sbi->s_uspi;
@@ -69,11 +69,15 @@ static bool ufs_read_cylinder(struct super_block *sb,
 	ucpi->c_clusteroff = fs32_to_cpu(sb, ucg->cg_u.cg_44.cg_clusteroff);
 	ucpi->c_nclusterblks = fs32_to_cpu(sb, ucg->cg_u.cg_44.cg_nclusterblks);
 
+	cgsize = UCPI_UBH(ucpi)->count << sb->s_blocksize_bits;
+
 	/* these on-disk values become array and bitmap indices */
 	if (ucpi->c_cgx != cgno ||
 	    ucpi->c_rotor >= uspi->s_fpg ||
 	    ucpi->c_frotor >= uspi->s_fpg ||
-	    ucpi->c_irotor >= uspi->s_ipg) {
+	    ucpi->c_irotor >= uspi->s_ipg ||
+	    ucpi->c_iusedoff >= cgsize ||
+	    DIV_ROUND_UP_ULL(uspi->s_ipg, 8) > cgsize - ucpi->c_iusedoff) {
 		ufs_error(sb, __func__,
 			  "inconsistent metadata in cylinder group %u\n", cgno);
 		goto failed;
-- 
2.25.1