Vulnerability: The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.
Vulnerability ID: CVE-2013-1819
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2013-03-06
File: fs/xfs/xfs_buf.c
Commit message: xfs: fix _xfs_buf_find oops on blocks beyond the filesystem end

When _xfs_buf_find is passed an out of range address, it will fail
to find a relevant struct xfs_perag and oops with a null
dereference. This can happen when trying to walk a filesystem with a
metadata inode that has a partially corrupted extent map (i.e. the
block number returned is corrupt, but is otherwise intact) and we
try to read from the corrupted block address.

In this case, just fail the lookup. If it is readahead being issued,
it will simply not be done, but if it is real read that fails we
will get an error being reported.  Ideally this case should result
in an EFSCORRUPTED error being reported, but we cannot return an
error through xfs_buf_read() or xfs_buf_get() so this lookup failure
may result in ENOMEM or EIO errors being reported instead.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Ben Myers <bpm@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
Commit author: Dave Chinner

Vulnerable version (before fix):
 _xfs_buf_find( 	struct rb_node		*parent; 	xfs_buf_t		*bp; 	xfs_daddr_t		blkno = map[0].bm_bn; 	int			numblks = 0; 	int			i;  _xfs_buf_find( 	ASSERT(!(numbytes < (1 << btp->bt_sshift))); 	ASSERT(!(BBTOB(blkno) & (xfs_off_t)btp->bt_smask));  	/* get tree root */ 	pag = xfs_perag_get(btp->bt_mount, 				xfs_daddr_to_agno(btp->bt_mount, blkno));

Fixed version (after fix):
 _xfs_buf_find( 	struct rb_node		*parent; 	xfs_buf_t		*bp; 	xfs_daddr_t		blkno = map[0].bm_bn; 	xfs_daddr_t		eofs; 	int			numblks = 0; 	int			i;  _xfs_buf_find( 	ASSERT(!(numbytes < (1 << btp->bt_sshift))); 	ASSERT(!(BBTOB(blkno) & (xfs_off_t)btp->bt_smask));  	/* 	 * Corrupted block numbers can get through to here, unfortunately, so we 	 * have to check that the buffer falls within the filesystem bounds. 	 */ 	eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks); 	if (blkno >= eofs) { 		/* 		 * XXX (dgc): we should really be returning EFSCORRUPTED here, 		 * but none of the higher level infrastructure supports 		 * returning a specific error on buffer lookup failures. 		 */ 		xfs_alert(btp->bt_mount, 			  "%s: Block out of range: block 0x%llx, EOFS 0x%llx ", 			  __func__, blkno, eofs); 		return NULL; 	}  	/* get tree root */ 	pag = xfs_perag_get(btp->bt_mount, 				xfs_daddr_to_agno(btp->bt_mount, blkno));

Patch:
patch: @@ -487,6 +487,7 @@ _xfs_buf_find(
 	struct rb_node		*parent;
 	xfs_buf_t		*bp;
 	xfs_daddr_t		blkno = map[0].bm_bn;
+	xfs_daddr_t		eofs;
 	int			numblks = 0;
 	int			i;
 
@@ -498,6 +499,23 @@ _xfs_buf_find(
 	ASSERT(!(numbytes < (1 << btp->bt_sshift)));
 	ASSERT(!(BBTOB(blkno) & (xfs_off_t)btp->bt_smask));
 
+	/*
+	 * Corrupted block numbers can get through to here, unfortunately, so we
+	 * have to check that the buffer falls within the filesystem bounds.
+	 */
+	eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks);
+	if (blkno >= eofs) {
+		/*
+		 * XXX (dgc): we should really be returning EFSCORRUPTED here,
+		 * but none of the higher level infrastructure supports
+		 * returning a specific error on buffer lookup failures.
+		 */
+		xfs_alert(btp->bt_mount,
+			  "%s: Block out of range: block 0x%llx, EOFS 0x%llx ",
+			  __func__, blkno, eofs);
+		return NULL;
+	}
+
 	/* get tree root */
 	pag = xfs_perag_get(btp->bt_mount,
 				xfs_daddr_to_agno(btp->bt_mount, blkno));
path: fs/xfs/xfs_buf.c