Merge tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 fixes from Ted Ts'o:
 "A security fix (so a maliciously corrupted file system image won't
  panic the kernel) and some fixes for CONFIG_VMAP_STACK"

* tag 'ext4_for_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: sanity check the block and cluster size at mount time
  fscrypto: don't use on-stack buffer for key derivation
  fscrypto: don't use on-stack buffer for filename encryption

4 files changed, 51 insertions, 36 deletions

diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 9a28133ac3b8..9b774f4b50c8 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -39,65 +39,54 @@ static void fname_crypt_complete(struct crypto_async_request *req, int res)
 static int fname_encrypt(struct inode *inode,
                         const struct qstr *iname, struct fscrypt_str *oname)
 {
-        u32 ciphertext_len;
         struct skcipher_request *req = NULL;
         DECLARE_FS_COMPLETION_RESULT(ecr);
         struct fscrypt_info *ci = inode->i_crypt_info;
         struct crypto_skcipher *tfm = ci->ci_ctfm;
         int res = 0;
         char iv[FS_CRYPTO_BLOCK_SIZE];
-        struct scatterlist src_sg, dst_sg;
+        struct scatterlist sg;
         int padding = 4 << (ci->ci_flags & FS_POLICY_FLAGS_PAD_MASK);
-        char *workbuf, buf[32], *alloc_buf = NULL;
-        unsigned lim;
+        unsigned int lim;
+        unsigned int cryptlen;
 
         lim = inode->i_sb->s_cop->max_namelen(inode);
         if (iname->len <= 0 || iname->len > lim)
                 return -EIO;
 
-        ciphertext_len = max(iname->len, (u32)FS_CRYPTO_BLOCK_SIZE);
-        ciphertext_len = round_up(ciphertext_len, padding);
-        ciphertext_len = min(ciphertext_len, lim);
+        /*
+         * Copy the filename to the output buffer for encrypting in-place and
+         * pad it with the needed number of NUL bytes.
+         */
+        cryptlen = max_t(unsigned int, iname->len, FS_CRYPTO_BLOCK_SIZE);
+        cryptlen = round_up(cryptlen, padding);
+        cryptlen = min(cryptlen, lim);
+        memcpy(oname->name, iname->name, iname->len);
+        memset(oname->name + iname->len, 0, cryptlen - iname->len);
 
-        if (ciphertext_len <= sizeof(buf)) {
-                workbuf = buf;
-        } else {
-                alloc_buf = kmalloc(ciphertext_len, GFP_NOFS);
-                if (!alloc_buf)
-                        return -ENOMEM;
-                workbuf = alloc_buf;
-        }
+        /* Initialize the IV */
+        memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);
 
-        /* Allocate request */
+        /* Set up the encryption request */
         req = skcipher_request_alloc(tfm, GFP_NOFS);
         if (!req) {
                 printk_ratelimited(KERN_ERR
-                        "%s: crypto_request_alloc() failed\n", __func__);
-                kfree(alloc_buf);
+                        "%s: skcipher_request_alloc() failed\n", __func__);
                 return -ENOMEM;
         }
         skcipher_request_set_callback(req,
                         CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
                         fname_crypt_complete, &ecr);
+        sg_init_one(&sg, oname->name, cryptlen);
+        skcipher_request_set_crypt(req, &sg, &sg, cryptlen, iv);
 
-        /* Copy the input */
-        memcpy(workbuf, iname->name, iname->len);
-        if (iname->len < ciphertext_len)
-                memset(workbuf + iname->len, 0, ciphertext_len - iname->len);
-
-        /* Initialize IV */
-        memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);
-
-        /* Create encryption request */
-        sg_init_one(&src_sg, workbuf, ciphertext_len);
-        sg_init_one(&dst_sg, oname->name, ciphertext_len);
-        skcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv);
+        /* Do the encryption */
         res = crypto_skcipher_encrypt(req);
         if (res == -EINPROGRESS || res == -EBUSY) {
+                /* Request is being completed asynchronously; wait for it */
                 wait_for_completion(&ecr.completion);
                 res = ecr.res;
         }
-        kfree(alloc_buf);
         skcipher_request_free(req);
         if (res < 0) {
                 printk_ratelimited(KERN_ERR
@@ -105,7 +94,7 @@ static int fname_encrypt(struct inode *inode,
                 return res;
         }
 
-        oname->len = ciphertext_len;
+        oname->len = cryptlen;
         return 0;
 }
 
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index 82f0285f5d08..67fb6d8876d0 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -185,7 +185,7 @@ int get_crypt_info(struct inode *inode)
         struct crypto_skcipher *ctfm;
         const char *cipher_str;
         int keysize;
-        u8 raw_key[FS_MAX_KEY_SIZE];
+        u8 *raw_key = NULL;
         int res;
 
         res = fscrypt_initialize();
@@ -238,6 +238,15 @@ retry:
         if (res)
                 goto out;
 
+        /*
+         * This cannot be a stack buffer because it is passed to the scatterlist
+         * crypto API as part of key derivation.
+         */
+        res = -ENOMEM;
+        raw_key = kmalloc(FS_MAX_KEY_SIZE, GFP_NOFS);
+        if (!raw_key)
+                goto out;
+
         if (fscrypt_dummy_context_enabled(inode)) {
                 memset(raw_key, 0x42, FS_AES_256_XTS_KEY_SIZE);
                 goto got_key;
@@ -276,7 +285,8 @@ got_key:
         if (res)
                 goto out;
 
-        memzero_explicit(raw_key, sizeof(raw_key));
+        kzfree(raw_key);
+        raw_key = NULL;
         if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
                 put_crypt_info(crypt_info);
                 goto retry;
@@ -287,7 +297,7 @@ out:
         if (res == -ENOKEY)
                 res = 0;
         put_crypt_info(crypt_info);
-        memzero_explicit(raw_key, sizeof(raw_key));
+        kzfree(raw_key);
         return res;
 }
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 282a51b07c57..a8a750f59621 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -235,6 +235,7 @@ struct ext4_io_submit {
 #define EXT4_MAX_BLOCK_SIZE             65536
 #define EXT4_MIN_BLOCK_LOG_SIZE         10
 #define EXT4_MAX_BLOCK_LOG_SIZE         16
+#define EXT4_MAX_CLUSTER_LOG_SIZE       30
 #ifdef __KERNEL__
 # define EXT4_BLOCK_SIZE(s)             ((s)->s_blocksize)
 #else
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 20da99da0a34..52b0530c5d65 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3565,7 +3565,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         if (blocksize < EXT4_MIN_BLOCK_SIZE ||
             blocksize > EXT4_MAX_BLOCK_SIZE) {
                 ext4_msg(sb, KERN_ERR,
-                       "Unsupported filesystem blocksize %d", blocksize);
+                       "Unsupported filesystem blocksize %d (%d log_block_size)",
+                         blocksize, le32_to_cpu(es->s_log_block_size));
+                goto failed_mount;
+        }
+        if (le32_to_cpu(es->s_log_block_size) >
+            (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+                ext4_msg(sb, KERN_ERR,
+                         "Invalid log block size: %u",
+                         le32_to_cpu(es->s_log_block_size));
                 goto failed_mount;
         }
 
@@ -3697,6 +3705,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                                  "block size (%d)", clustersize, blocksize);
                         goto failed_mount;
                 }
+                if (le32_to_cpu(es->s_log_cluster_size) >
+                    (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+                        ext4_msg(sb, KERN_ERR,
+                                 "Invalid log cluster size: %u",
+                                 le32_to_cpu(es->s_log_cluster_size));
+                        goto failed_mount;
+                }
                 sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) -
                         le32_to_cpu(es->s_log_block_size);
                 sbi->s_clusters_per_group =