md/raid5: validate payload size before accessing journal metadata

r5c_recovery_analyze_meta_block() and
r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a
journal metadata block using on-disk payload size fields without
validating them against the remaining space in the metadata block.

A corrupted journal contains payload sizes extending beyond the PAGE_SIZE
boundary can cause out-of-bounds reads when accessing payload fields or
computing offsets.

Add bounds validation for each payload type to ensure the full payload
fits within meta_size before processing.

Fixes: b4c625c67362 ("md/r5cache: r5cache recovery: part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@SYBPR01MB7881.ausprd01.prod.outlook.com/
Signed-off-by: Yu Kuai <yukuai@fnnas.com>

diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 66b10cbda96d66ee727e640bbe36f2fdca6fa8fc..7b7546bfa21fb0c4be62ac94ecf8c6da72b2edb3 100644 (file)
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2002,15 +2002,27 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
                return -ENOMEM;
 
        while (mb_offset < le32_to_cpu(mb->meta_size)) {
+               sector_t payload_len;
+
                payload = (void *)mb + mb_offset;
                payload_flush = (void *)mb + mb_offset;
 
                if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) {
+                       payload_len = sizeof(struct r5l_payload_data_parity) +
+                               (sector_t)sizeof(__le32) *
+                               (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
+                       if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+                               goto mismatch;
                        if (r5l_recovery_verify_data_checksum(
                                    log, ctx, page, log_offset,
                                    payload->checksum[0]) < 0)
                                goto mismatch;
                } else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) {
+                       payload_len = sizeof(struct r5l_payload_data_parity) +
+                               (sector_t)sizeof(__le32) *
+                               (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
+                       if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+                               goto mismatch;
                        if (r5l_recovery_verify_data_checksum(
                                    log, ctx, page, log_offset,
                                    payload->checksum[0]) < 0)
@@ -2023,22 +2035,18 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log,
                                    payload->checksum[1]) < 0)
                                goto mismatch;
                } else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
-                       /* nothing to do for R5LOG_PAYLOAD_FLUSH here */
+                       payload_len = sizeof(struct r5l_payload_flush) +
+                               (sector_t)le32_to_cpu(payload_flush->size);
+                       if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+                               goto mismatch;
                } else /* not R5LOG_PAYLOAD_DATA/PARITY/FLUSH */
                        goto mismatch;
 
-               if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
-                       mb_offset += sizeof(struct r5l_payload_flush) +
-                               le32_to_cpu(payload_flush->size);
-               } else {
-                       /* DATA or PARITY payload */
+               if (le16_to_cpu(payload->header.type) != R5LOG_PAYLOAD_FLUSH) {
                        log_offset = r5l_ring_add(log, log_offset,
                                                  le32_to_cpu(payload->size));
-                       mb_offset += sizeof(struct r5l_payload_data_parity) +
-                               sizeof(__le32) *
-                               (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
                }
-
+               mb_offset += payload_len;
        }
 
        put_page(page);
@@ -2089,6 +2097,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
        log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS);
 
        while (mb_offset < le32_to_cpu(mb->meta_size)) {
+               sector_t payload_len;
                int dd;
 
                payload = (void *)mb + mb_offset;
@@ -2097,6 +2106,12 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) {
                        int i, count;
 
+                       payload_len = sizeof(struct r5l_payload_flush) +
+                               (sector_t)le32_to_cpu(payload_flush->size);
+                       if (mb_offset + payload_len >
+                           le32_to_cpu(mb->meta_size))
+                               return -EINVAL;
+
                        count = le32_to_cpu(payload_flush->size) / sizeof(__le64);
                        for (i = 0; i < count; ++i) {
                                stripe_sect = le64_to_cpu(payload_flush->flush_stripes[i]);
@@ -2110,12 +2125,17 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                }
                        }
 
-                       mb_offset += sizeof(struct r5l_payload_flush) +
-                               le32_to_cpu(payload_flush->size);
+                       mb_offset += payload_len;
                        continue;
                }
 
                /* DATA or PARITY payload */
+               payload_len = sizeof(struct r5l_payload_data_parity) +
+                       (sector_t)sizeof(__le32) *
+                       (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
+               if (mb_offset + payload_len > le32_to_cpu(mb->meta_size))
+                       return -EINVAL;
+
                stripe_sect = (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) ?
                        raid5_compute_sector(
                                conf, le64_to_cpu(payload->location), 0, &dd,
@@ -2180,9 +2200,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                log_offset = r5l_ring_add(log, log_offset,
                                          le32_to_cpu(payload->size));
 
-               mb_offset += sizeof(struct r5l_payload_data_parity) +
-                       sizeof(__le32) *
-                       (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9));
+               mb_offset += payload_len;
        }
 
        return 0;