CVE-2011-4098 (C, published 2013-06-08T13:05Z)
Description: value: The fallocate implementation in the GFS2 filesystem in the Linux kernel before 3.2 relies on the page cache, which might allow local users to cause a denial of service by preallocating blocks in certain situations involving insufficient memory.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/torvalds/linux
Files changed:
fs/gfs2/bmap.c
fs/gfs2/file.c
fs/gfs2/incore.h
Commit message: GFS2: rewrite fallocate code to write blocks directly

GFS2's fallocate code currently goes through the page cache. Since it's only
writing to the end of the file or to holes in it, it doesn't need to, and it
was causing issues on low memory environments. This patch pulls in some of
Steve's block allocation work, and uses it to simply allocate the blocks for
the file, and zero them out at allocation time.  It provides a slight
performance increase, and it dramatically simplifies the code.

Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>


Vulnerable code:
static int empty_write_end(struct page *page, unsigned from,
			   unsigned to, int mode)
{
	struct inode *inode = page->mapping->host;
	struct gfs2_inode *ip = GFS2_I(inode);
	struct buffer_head *bh;
	unsigned offset, blksize = 1 << inode->i_blkbits;
	pgoff_t end_index = i_size_read(inode) >> PAGE_CACHE_SHIFT;

	zero_user(page, from, to-from);
	mark_page_accessed(page);

	if (page->index < end_index || !(mode & FALLOC_FL_KEEP_SIZE)) {
		if (!gfs2_is_writeback(ip))
			gfs2_page_add_databufs(ip, page, from, to);

		block_commit_write(page, from, to);
		return 0;
	}

	offset = 0;
	bh = page_buffers(page);
	while (offset < to) {
		if (offset >= from) {
			set_buffer_uptodate(bh);
			mark_buffer_dirty(bh);
			clear_buffer_new(bh);
			write_dirty_buffer(bh, WRITE);
		}
		offset += blksize;
		bh = bh->b_this_page;
	}

	offset = 0;
	bh = page_buffers(page);
	while (offset < to) {
		if (offset >= from) {
			wait_on_buffer(bh);
			if (!buffer_uptodate(bh))
				return -EIO;
		}
		offset += blksize;
		bh = bh->b_this_page;
	}
	return 0;
}

static int needs_empty_write(sector_t block, struct inode *inode)
{
	int error;
	struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };

	bh_map.b_size = 1 << inode->i_blkbits;
	error = gfs2_block_map(inode, block, &bh_map, 0);
	if (unlikely(error))
		return error;
	return !buffer_mapped(&bh_map);
}

static int write_empty_blocks(struct page *page, unsigned from, unsigned to,
			      int mode)
{
	struct inode *inode = page->mapping->host;
	unsigned start, end, next, blksize;
	sector_t block = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
	int ret;

	blksize = 1 << inode->i_blkbits;
	next = end = 0;
	while (next < from) {
		next += blksize;
		block++;
	}
	start = next;
	do {
		next += blksize;
		ret = needs_empty_write(block, inode);
		if (unlikely(ret < 0))
			return ret;
		if (ret == 0) {
			if (end) {
				ret = __block_write_begin(page, start, end - start,
							  gfs2_block_map);
				if (unlikely(ret))
					return ret;
				ret = empty_write_end(page, start, end, mode);
				if (unlikely(ret))
					return ret;
				end = 0;
			}
			start = next;
		}
		else
			end = next;
		block++;
	} while (next < to);

	if (end) {
		ret = __block_write_begin(page, start, end - start, gfs2_block_map);
		if (unlikely(ret))
			return ret;
		ret = empty_write_end(page, start, end, mode);
		if (unlikely(ret))
			return ret;
	}

	return 0;
}

	u64 start = offset >> PAGE_CACHE_SHIFT;
	unsigned int start_offset = offset & ~PAGE_CACHE_MASK;
	u64 end = (offset + len - 1) >> PAGE_CACHE_SHIFT;
	pgoff_t curr;
	struct page *page;
	unsigned int end_offset = (offset + len) & ~PAGE_CACHE_MASK;
	unsigned int from, to;

	if (!end_offset)
		end_offset = PAGE_CACHE_SIZE;
		goto out;
	curr = start;
	offset = start << PAGE_CACHE_SHIFT;
	from = start_offset;
	to = PAGE_CACHE_SIZE;
	while (curr <= end) {
		page = grab_cache_page_write_begin(inode->i_mapping, curr,
						   AOP_FLAG_NOFS);
		if (unlikely(!page)) {
			error = -ENOMEM;
			goto out;
		}
		if (curr == end)
			to = end_offset;
		error = write_empty_blocks(page, from, to, mode);
		if (!error && offset + to > inode->i_size &&
		    !(mode & FALLOC_FL_KEEP_SIZE)) {
			i_size_write(inode, offset + to);
		}
		unlock_page(page);
		page_cache_release(page);
		if (error)
		curr++;
		offset += PAGE_CACHE_SIZE;
		from = 0;
	brelse(dibh);

		calc_max_reserv(ip, len, &max_bytes, &data_blocks, &ind_blocks);

Fixed code:
#include <linux/blkdev.h>
	struct super_block *sb = sdp->sd_vfs;
	int ret;
			if (buffer_zeronew(bh_map)) {
				ret = sb_issue_zeroout(sb, dblock, dblks,
						       GFP_NOFS);
				if (ret) {
					fs_err(sdp,
					       "Failed to zero data buffers\n");
					clear_buffer_zeronew(bh_map);
				}
			}
	unsigned int nr_blks;
	sector_t lblock = offset >> inode->i_blkbits;
		return error;
	while (len) {
		struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
		bh_map.b_size = len;
		set_buffer_zeronew(&bh_map);
		error = gfs2_block_map(inode, lblock, &bh_map, 1);
		if (unlikely(error))
		len -= bh_map.b_size;
		nr_blks = bh_map.b_size >> inode->i_blkbits;
		lblock += nr_blks;
		if (!buffer_new(&bh_map))
			continue;
		if (unlikely(!buffer_zeronew(&bh_map))) {
			error = -EIO;
			goto out;
		}
	if (offset + len > inode->i_size && !(mode & FALLOC_FL_KEEP_SIZE))
		i_size_write(inode, offset + len);
	brelse(dibh);
	loff_t max_chunk_size = UINT_MAX & bsize_mask;
		calc_max_reserv(ip, (len > max_chunk_size)? max_chunk_size: len,
				&max_bytes, &data_blocks, &ind_blocks);
	BH_Zeronew = BH_PrivateStart + 2,
BUFFER_FNS(Zeronew, zeronew)
TAS_BUFFER_FNS(Zeronew, zeronew)