From: Eric Biggers <ebiggers@kernel.org>
To: linux-ext4@vger.kernel.org
Cc: linux-fscrypt@vger.kernel.org, stable@vger.kernel.org,
syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com
Subject: Re: [PATCH] ext4: don't allow journal inode to have encrypt flag
Date: Tue, 29 Nov 2022 00:23:36 +0000 [thread overview]
Message-ID: <Y4VRCIk4JQyH+utN@gmail.com> (raw)
In-Reply-To: <20221102053312.189962-1-ebiggers@kernel.org>
On Tue, Nov 01, 2022 at 10:33:12PM -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Mounting a filesystem whose journal inode has the encrypt flag causes a
> NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt'
> mount option is used.
>
> The problem is that when jbd2_journal_init_inode() calls bmap(), it
> eventually finds its way into ext4_iomap_begin(), which calls
> fscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if
> the inode is encrypted, then its encryption key must already be set up.
> That's not the case here, since the journal inode is never "opened" like
> a normal file would be. Hence the crash.
>
> A reproducer is:
>
> mkfs.ext4 -F /dev/vdb
> debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808"
> mount /dev/vdb /mnt -o inlinecrypt
>
> To fix this, make ext4 consider journal inodes with the encrypt flag to
> be invalid. (Note, maybe other flags should be rejected on the journal
> inode too. For now, this is just the minimal fix for the above issue.)
>
> I've marked this as fixing the commit that introduced the call to
> fscrypt_limit_io_blocks(), since that's what made an actual crash start
> being possible. But this fix could be applied to any version of ext4
> that supports the encrypt feature.
>
> Reported-by: syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com
> Fixes: 38ea50daa7a4 ("ext4: support direct I/O with fscrypt using blk-crypto")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
> fs/ext4/super.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 7950904fbf04f..2274f730b87e5 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -5723,7 +5723,7 @@ static struct inode *ext4_get_journal_inode(struct super_block *sb,
>
> ext4_debug("Journal inode found at %p: %lld bytes\n",
> journal_inode, journal_inode->i_size);
> - if (!S_ISREG(journal_inode->i_mode)) {
> + if (!S_ISREG(journal_inode->i_mode) || IS_ENCRYPTED(journal_inode)) {
> ext4_msg(sb, KERN_ERR, "invalid journal inode");
> iput(journal_inode);
> return NULL;
>
> base-commit: 8f71a2b3f435f29b787537d1abedaa7d8ebe6647
> --
Ping.
- Eric
next prev parent reply other threads:[~2022-11-29 0:23 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-02 5:33 [PATCH] ext4: don't allow journal inode to have encrypt flag Eric Biggers
2022-11-29 0:23 ` Eric Biggers [this message]
2022-12-06 21:01 ` Theodore Ts'o
2022-12-08 3:41 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y4VRCIk4JQyH+utN@gmail.com \
--to=ebiggers@kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).