[edk2-platforms][PATCH v4 00/12] Ext4Pkg: Code correctness and security improvements

[edk2-platforms][PATCH v4 00/12] Ext4Pkg: Code correctness and security improvements

[Savva Mitrofanov]

Hi all,

In v4 I rebased patches according upstream. Also in this revision I corrected
all remarks and comments from v3.

This patchset fixes several code problems found by fuzzing Ext4Dxe like
buffer and integer overflows, memory leaks, logic bugs and so on.

REF: https://github.com/savvamitrofanov/edk2-platforms/tree/master

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>

Savva Mitrofanov (12):
  Ext4Pkg: Fix memory leak in Ext4RetrieveDirent
  Ext4Pkg: Fix incorrect checksum metadata feature check
  Ext4Pkg: Fix division by zero by adding check for s_inodes_per_group
  Ext4Pkg: Add inode number validity check
  Ext4Pkg: Fix shift out of bounds in Ext4OpenSuperblock
  Ext4Pkg: Corrects integer overflow check logic in DiskUtil
  Ext4Pkg: Check that source file is directory in Ext4OpenInternal
  Ext4Pkg: Check VolumeName allocation correctness in Ext4GetVolumeName
  Ext4Pkg: Add missing exit Status in Ext4OpenDirent
  Ext4Pkg: Fixes build on MSVC
  Ext4Pkg: Filter out directory entry names containing \0 as invalid
  Ext4Pkg: Corrects memory leak in Ext4ReadSlowSymlink

 Features/Ext4Pkg/Ext4Pkg.dsc          |  2 +-
 Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h   | 13 +++++-
 Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h    | 26 ++++++++++++
 Features/Ext4Pkg/Ext4Dxe/BlockGroup.c |  5 +++
 Features/Ext4Pkg/Ext4Dxe/Directory.c  | 42 ++++++++++++--------
 Features/Ext4Pkg/Ext4Dxe/DiskUtil.c   | 18 +++++++--
 Features/Ext4Pkg/Ext4Dxe/Extents.c    | 15 +++++--
 Features/Ext4Pkg/Ext4Dxe/File.c       | 23 ++++++++---
 Features/Ext4Pkg/Ext4Dxe/Inode.c      |  6 +--
 Features/Ext4Pkg/Ext4Dxe/Superblock.c | 16 ++++++--
 Features/Ext4Pkg/Ext4Dxe/Symlink.c    | 13 +++---
 11 files changed, 134 insertions(+), 45 deletions(-)

-- 
2.39.1

[edk2-platforms][PATCH v4 01/12] Ext4Pkg: Fix memory leak in Ext4RetrieveDirent

[Savva Mitrofanov]

We need to free buffer on return if BlockRemainder != 0. Also changed
return logic from function to use use common exit to prevent code
duplication.

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Directory.c | 30 +++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Directory.c b/Features/Ext4Pkg/Ext4Dxe/Directory.c
index 73d21d9f9542..c7992cc72717 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Directory.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Directory.c
@@ -113,8 +113,7 @@ Ext4RetrieveDirent (
   UINTN           ToCopy;
   UINTN           BlockOffset;
 
-  Status = EFI_NOT_FOUND;
-  Buf    = AllocatePool (Partition->BlockSize);
+  Buf = AllocatePool (Partition->BlockSize);
 
   if (Buf == NULL) {
     return EFI_OUT_OF_RESOURCES;
@@ -128,7 +127,8 @@ Ext4RetrieveDirent (
   DivU64x32Remainder (DirInoSize, Partition->BlockSize, &BlockRemainder);
   if (BlockRemainder != 0) {
     // Directory inodes need to have block aligned sizes
-    return EFI_VOLUME_CORRUPTED;
+    Status = EFI_VOLUME_CORRUPTED;
+    goto Out;
   }
 
   while (Off < DirInoSize) {
@@ -137,8 +137,7 @@ Ext4RetrieveDirent (
     Status = Ext4Read (Partition, Directory, Buf, Off, &Length);
 
     if (Status != EFI_SUCCESS) {
-      FreePool (Buf);
-      return Status;
+      goto Out;
     }
 
     for (BlockOffset = 0; BlockOffset < Partition->BlockSize; ) {
@@ -146,19 +145,19 @@ Ext4RetrieveDirent (
       RemainingBlock = Partition->BlockSize - BlockOffset;
       // Check if the minimum directory entry fits inside [BlockOffset, EndOfBlock]
       if (RemainingBlock < EXT4_MIN_DIR_ENTRY_LEN) {
-        FreePool (Buf);
-        return EFI_VOLUME_CORRUPTED;
+        Status = EFI_VOLUME_CORRUPTED;
+        goto Out;
       }
 
       if (!Ext4ValidDirent (Entry)) {
-        FreePool (Buf);
-        return EFI_VOLUME_CORRUPTED;
+        Status = EFI_VOLUME_CORRUPTED;
+        goto Out;
       }
 
       if ((Entry->name_len > RemainingBlock) || (Entry->rec_len > RemainingBlock)) {
         // Corrupted filesystem
-        FreePool (Buf);
-        return EFI_VOLUME_CORRUPTED;
+        Status = EFI_VOLUME_CORRUPTED;
+        goto Out;
       }
 
       // Unused entry
@@ -193,8 +192,8 @@ Ext4RetrieveDirent (
         ToCopy = MIN (Entry->rec_len, sizeof (EXT4_DIR_ENTRY));
 
         CopyMem (Result, Entry, ToCopy);
-        FreePool (Buf);
-        return EFI_SUCCESS;
+        Status = EFI_SUCCESS;
+        goto Out;
       }
 
       BlockOffset += Entry->rec_len;
@@ -203,8 +202,11 @@ Ext4RetrieveDirent (
     Off += Partition->BlockSize;
   }
 
+  Status = EFI_NOT_FOUND;
+
+Out:
   FreePool (Buf);
-  return EFI_NOT_FOUND;
+  return Status;
 }
 
 /**
-- 
2.39.1

[edk2-platforms][PATCH v4 02/12] Ext4Pkg: Fix incorrect checksum metadata feature check

[Savva Mitrofanov]

We need to check EXT4_FEATURE_RO_COMPAT_METADATA_CSUM in the
FeatureRoCompat field instead of FeaturesCompat. The proper way to do
this is to use macro EXT4_HAS_METADATA_CSUM.
Also, replace the EXT4_FEATURE_INCOMPAT_CSUM_SEED check with predefined
macro EXT4_HAS_INCOMPAT

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Superblock.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Superblock.c b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
index 5a3c7f478187..35dcf3c007c8 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Superblock.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
@@ -220,13 +220,11 @@ Ext4OpenSuperblock (
   }
 
   // At the time of writing, it's the only supported checksum.
-  if (Partition->FeaturesCompat & EXT4_FEATURE_RO_COMPAT_METADATA_CSUM &&
-      (Sb->s_checksum_type != EXT4_CHECKSUM_CRC32C))
-  {
+  if (EXT4_HAS_METADATA_CSUM (Partition) && (Sb->s_checksum_type != EXT4_CHECKSUM_CRC32C)) {
     return EFI_UNSUPPORTED;
   }
 
-  if ((Partition->FeaturesIncompat & EXT4_FEATURE_INCOMPAT_CSUM_SEED) != 0) {
+  if (EXT4_HAS_INCOMPAT (Partition, EXT4_FEATURE_INCOMPAT_CSUM_SEED)) {
     Partition->InitialSeed = Sb->s_checksum_seed;
   } else {
     Partition->InitialSeed = Ext4CalculateChecksum (Partition, Sb->s_uuid, 16, ~0U);
-- 
2.39.1

[edk2-platforms][PATCH v4 03/12] Ext4Pkg: Fix division by zero by adding check for s_inodes_per_group

[Savva Mitrofanov]

Superblock s_inodes_per_group field can't be zero, it leads to division
by zero in BlockGroup routine Ext4ReadInode

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Superblock.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Superblock.c b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
index 35dcf3c007c8..be3527e4d618 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Superblock.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
@@ -243,6 +243,11 @@ Ext4OpenSuperblock (
 
   DEBUG ((DEBUG_FS, "Read only = %u\n", Partition->ReadOnly));
 
+  if (Sb->s_inodes_per_group == 0) {
+    DEBUG ((DEBUG_ERROR, "[ext4] Inodes per group can not be zero\n"));
+    return EFI_VOLUME_CORRUPTED;
+  }
+
   Partition->BlockSize = (UINT32)LShiftU64 (1024, Sb->s_log_block_size);
 
   // The size of a block group can also be calculated as 8 * Partition->BlockSize
-- 
2.39.1

[edk2-platforms][PATCH v4 04/12] Ext4Pkg: Add inode number validity check

[Savva Mitrofanov]

We need to validate inode number to prevent reading non-existent and
incorrect inodes so we checks that inode number valid across opened
partition before we read it in Ext4ReadInode.

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
---
 Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h   | 13 +++++++++++--
 Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h    | 12 ++++++++++++
 Features/Ext4Pkg/Ext4Dxe/BlockGroup.c |  5 +++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h b/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
index d0a455d0e572..70cb6c3209dd 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
+++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
@@ -484,8 +484,17 @@ typedef UINT64  EXT4_BLOCK_NR;
 typedef UINT32  EXT2_BLOCK_NR;
 typedef UINT32  EXT4_INO_NR;
 
-// 2 is always the root inode number in ext4
-#define EXT4_ROOT_INODE_NR  2
+/* Special inode numbers */
+#define EXT4_ROOT_INODE_NR         2
+#define EXT4_USR_QUOTA_INODE_NR    3
+#define EXT4_GRP_QUOTA_INODE_NR    4
+#define EXT4_BOOT_LOADER_INODE_NR  5
+#define EXT4_UNDEL_DIR_INODE_NR    6
+#define EXT4_RESIZE_INODE_NR       7
+#define EXT4_JOURNAL_INODE_NR      8
+
+/* First non-reserved inode for old ext4 filesystems */
+#define EXT4_GOOD_OLD_FIRST_INODE_NR  11
 
 #define EXT4_BLOCK_FILE_HOLE  0
 
diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
index f608def7c9eb..c977a97ca5c2 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
+++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
@@ -287,6 +287,18 @@ Ext4GetBlockGroupDesc (
   IN UINT32          BlockGroup
   );
 
+/**
+   Checks inode number validity across superblock of the opened partition.
+   Currently we don't have logic to process defective blocks with
+   inode number equal 1, so we don't reject them at this point
+
+   @param[in]  Partition      Pointer to the opened ext4 partition.
+
+   @return TRUE if inode number is valid.
+**/
+#define EXT4_IS_VALID_INODE_NR(Partition, InodeNum)                            \
+  (((InodeNum) > 0) && (InodeNum) <= (Partition->SuperBlock.s_inodes_count))
+
 /**
    Reads an inode from disk.
 
diff --git a/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c b/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
index cba96cd95afc..f34cdc5dbad7 100644
--- a/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
+++ b/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
@@ -50,6 +50,11 @@ Ext4ReadInode (
   EXT4_BLOCK_NR          InodeTableStart;
   EFI_STATUS             Status;
 
+  if (!EXT4_IS_VALID_INODE_NR (Partition, InodeNum)) {
+    DEBUG ((DEBUG_ERROR, "[ext4] Error reading inode: inode number %lu isn't valid\n", InodeNum));
+    return EFI_VOLUME_CORRUPTED;
+  }
+
   BlockGroupNumber = (UINT32)DivU64x64Remainder (
                                InodeNum - 1,
                                Partition->SuperBlock.s_inodes_per_group,
-- 
2.39.1

[edk2-platforms][PATCH v4 05/12] Ext4Pkg: Fix shift out of bounds in Ext4OpenSuperblock

[Savva Mitrofanov]

Missing check for wrong s_log_block_size exponent leads to shift out of
bounds. Limit block size to 2 MiB

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h    | 14 ++++++++++++++
 Features/Ext4Pkg/Ext4Dxe/Superblock.c |  5 +++++
 2 files changed, 19 insertions(+)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
index c977a97ca5c2..d3f72a98d7f8 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
+++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
@@ -40,6 +40,20 @@
 #define EXT4_EFI_PATH_MAX    4096
 #define EXT4_DRIVER_VERSION  0x0000
 
+//
+// The EXT4 Specification doesn't strictly limit block size and this value could be up to 2^31,
+// but in practice it is limited by PAGE_SIZE due to performance significant impact.
+// Many EXT4 implementations have size of block limited to PAGE_SIZE. In many cases it's limited
+// to 4096, which is a commonly supported page size on most MMU-capable hardware, and up to 65536.
+// So, to take a balance between compatibility and security measures, it is decided to use the
+// value of 2MiB as the limit, which is equal to large page size on new hardware.
+// As for supporting big block sizes, EXT4 has a RO_COMPAT_FEATURE called BIGALLOC, which changes
+// EXT4 to use clustered allocation, so that each bit in the ext4 block allocation bitmap addresses
+// a power of two number of blocks. So it would be wiser to implement and use this feature
+// if there is such a need instead of big block size.
+//
+#define EXT4_LOG_BLOCK_SIZE_MAX  11
+
 /**
    Opens an ext4 partition and installs the Simple File System protocol.
 
diff --git a/Features/Ext4Pkg/Ext4Dxe/Superblock.c b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
index be3527e4d618..3f56de93c105 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Superblock.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Superblock.c
@@ -248,6 +248,11 @@ Ext4OpenSuperblock (
     return EFI_VOLUME_CORRUPTED;
   }
 
+  if (Sb->s_log_block_size > EXT4_LOG_BLOCK_SIZE_MAX) {
+    DEBUG ((DEBUG_ERROR, "[ext4] SuperBlock s_log_block_size %lu is too big\n", Sb->s_log_block_size));
+    return EFI_UNSUPPORTED;
+  }
+
   Partition->BlockSize = (UINT32)LShiftU64 (1024, Sb->s_log_block_size);
 
   // The size of a block group can also be calculated as 8 * Partition->BlockSize
-- 
2.39.1

[edk2-platforms][PATCH v4 06/12] Ext4Pkg: Corrects integer overflow check logic in DiskUtil

[Savva Mitrofanov]

Corrects multiplication overflow check code and adds additional check
for emptiness of number of blocks and block number

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
---
 Features/Ext4Pkg/Ext4Pkg.dsc        |  2 +-
 Features/Ext4Pkg/Ext4Dxe/DiskUtil.c | 18 ++++++++++++++----
 Features/Ext4Pkg/Ext4Dxe/Extents.c  | 15 ++++++++++++---
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Pkg.dsc b/Features/Ext4Pkg/Ext4Pkg.dsc
index 59bc327ebf6e..621c63eaf92d 100644
--- a/Features/Ext4Pkg/Ext4Pkg.dsc
+++ b/Features/Ext4Pkg/Ext4Pkg.dsc
@@ -46,7 +46,7 @@
   DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf
   BaseUcs2Utf8Lib|RedfishPkg/Library/BaseUcs2Utf8Lib/BaseUcs2Utf8Lib.inf
-  
+
   #
   # Required for stack protector support
   #
diff --git a/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c b/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
index 32da35f7d9f5..5df9ce5bafcf 100644
--- a/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
+++ b/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
@@ -54,17 +54,20 @@ Ext4ReadBlocks (
   UINT64  Offset;
   UINTN   Length;
 
+  ASSERT (NumberBlocks != 0);
+  ASSERT (BlockNumber != EXT4_BLOCK_FILE_HOLE);
+
   Offset = MultU64x32 (BlockNumber, Partition->BlockSize);
   Length = NumberBlocks * Partition->BlockSize;
 
   // Check for overflow on the block -> byte conversions.
   // Partition->BlockSize is never 0, so we don't need to check for that.
 
-  if (Offset > DivU64x32 ((UINT64)-1, Partition->BlockSize)) {
+  if (DivU64x64Remainder (Offset, BlockNumber, NULL) != Partition->BlockSize) {
     return EFI_INVALID_PARAMETER;
   }
 
-  if (Length > (UINTN)-1/Partition->BlockSize) {
+  if (Length / NumberBlocks != Partition->BlockSize) {
     return EFI_INVALID_PARAMETER;
   }
 
@@ -92,14 +95,21 @@ Ext4AllocAndReadBlocks (
   VOID   *Buf;
   UINTN  Length;
 
+  // Check that number of blocks isn't empty, because
+  // this is incorrect condition for opened partition,
+  // so we just early-exit
+  if ((NumberBlocks == 0) || (BlockNumber == EXT4_BLOCK_FILE_HOLE)) {
+    return NULL;
+  }
+
   Length = NumberBlocks * Partition->BlockSize;
 
-  if (Length > (UINTN)-1/Partition->BlockSize) {
+  // Check for integer overflow
+  if (Length / NumberBlocks != Partition->BlockSize) {
     return NULL;
   }
 
   Buf = AllocatePool (Length);
-
   if (Buf == NULL) {
     return NULL;
   }
diff --git a/Features/Ext4Pkg/Ext4Dxe/Extents.c b/Features/Ext4Pkg/Ext4Dxe/Extents.c
index e1001d0a4292..99cb0f204fc2 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Extents.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Extents.c
@@ -237,6 +237,7 @@ Ext4GetExtent (
   EXT4_EXTENT_HEADER  *ExtHeader;
   EXT4_EXTENT_INDEX   *Index;
   EFI_STATUS          Status;
+  EXT4_BLOCK_NR       BlockNumber;
 
   Inode  = File->Inode;
   Ext    = NULL;
@@ -288,7 +289,16 @@ Ext4GetExtent (
     // Therefore, we can use binary search, and it's actually the standard for doing so
     // (see FreeBSD).
 
-    Index = Ext4BinsearchExtentIndex (ExtHeader, LogicalBlock);
+    Index       = Ext4BinsearchExtentIndex (ExtHeader, LogicalBlock);
+    BlockNumber = Ext4ExtentIdxLeafBlock (Index);
+
+    // Check that block isn't file hole
+    if (BlockNumber == EXT4_BLOCK_FILE_HOLE) {
+      if (Buffer != NULL) {
+        FreePool (Buffer);
+      }
+      return EFI_NO_MAPPING;
+    }
 
     if (Buffer == NULL) {
       Buffer = AllocatePool (Partition->BlockSize);
@@ -298,8 +308,7 @@ Ext4GetExtent (
     }
 
     // Read the leaf block onto the previously-allocated buffer.
-
-    Status = Ext4ReadBlocks (Partition, Buffer, 1, Ext4ExtentIdxLeafBlock (Index));
+    Status = Ext4ReadBlocks (Partition, Buffer, 1, BlockNumber);
     if (EFI_ERROR (Status)) {
       FreePool (Buffer);
       return Status;
-- 
2.39.1

[edk2-platforms][PATCH v4 07/12] Ext4Pkg: Check that source file is directory in Ext4OpenInternal

[Savva Mitrofanov]

This check already present in the while loop below, but absent for cases
when input file is nameless, so to handle assertion in Ext4ReadFile we
need to add it at the top of function

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/File.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/File.c b/Features/Ext4Pkg/Ext4Dxe/File.c
index 8dfe324255f4..9dde4a5d1a2d 100644
--- a/Features/Ext4Pkg/Ext4Dxe/File.c
+++ b/Features/Ext4Pkg/Ext4Dxe/File.c
@@ -207,6 +207,11 @@ Ext4OpenInternal (
   Level     = 0;
 
   DEBUG ((DEBUG_FS, "[ext4] Ext4OpenInternal %s\n", FileName));
+
+  if (!Ext4FileIsDir (Current)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
   // If the path starts with a backslash, we treat the root directory as the base directory
   if (FileName[0] == L'\\') {
     FileName++;
@@ -219,6 +224,10 @@ Ext4OpenInternal (
       return EFI_ACCESS_DENIED;
     }
 
+    if (!Ext4FileIsDir (Current)) {
+      return EFI_INVALID_PARAMETER;
+    }
+
     // Discard leading path separators
     while (FileName[0] == L'\\') {
       FileName++;
@@ -242,10 +251,6 @@ Ext4OpenInternal (
 
     DEBUG ((DEBUG_FS, "[ext4] Opening %s\n", PathSegment));
 
-    if (!Ext4FileIsDir (Current)) {
-      return EFI_INVALID_PARAMETER;
-    }
-
     if (!Ext4IsLastPathSegment (FileName)) {
       if (!Ext4DirCanLookup (Current)) {
         return EFI_ACCESS_DENIED;
-- 
2.39.1

[edk2-platforms][PATCH v4 08/12] Ext4Pkg: Check VolumeName allocation correctness in Ext4GetVolumeName

[Savva Mitrofanov]

Missing check in some cases leads to failed StrCpyS call in
Ext4GetVolumeLabelInfo. Also correct condition that checks Inode pointer
for being NULL in Ext4AllocateInode

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: cfbbae595eec ("Ext4Pkg: Add handling of EFI_FILE_SYSTEM_VOLUME_LABEL GetInfo().")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/File.c  | 10 ++++++++--
 Features/Ext4Pkg/Ext4Dxe/Inode.c |  2 +-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/File.c b/Features/Ext4Pkg/Ext4Dxe/File.c
index 9dde4a5d1a2d..677caf88fbdc 100644
--- a/Features/Ext4Pkg/Ext4Dxe/File.c
+++ b/Features/Ext4Pkg/Ext4Dxe/File.c
@@ -719,7 +719,11 @@ Ext4GetVolumeName (
 
     VolNameLength = StrLen (VolumeName);
   } else {
-    VolumeName    = AllocateZeroPool (sizeof (CHAR16));
+    VolumeName = AllocateZeroPool (sizeof (CHAR16));
+    if (VolumeName == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    }
+
     VolNameLength = 0;
   }
 
@@ -786,7 +790,9 @@ Ext4GetFilesystemInfo (
   Info->VolumeSize = MultU64x32 (TotalBlocks, Part->BlockSize);
   Info->FreeSpace  = MultU64x32 (FreeBlocks, Part->BlockSize);
 
-  StrCpyS (Info->VolumeLabel, VolNameLength + 1, VolumeName);
+  Status = StrCpyS (Info->VolumeLabel, VolNameLength + 1, VolumeName);
+
+  ASSERT_EFI_ERROR (Status);
 
   FreePool (VolumeName);
 
diff --git a/Features/Ext4Pkg/Ext4Dxe/Inode.c b/Features/Ext4Pkg/Ext4Dxe/Inode.c
index e44b5638599f..90e3eb88f523 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Inode.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Inode.c
@@ -230,7 +230,7 @@ Ext4AllocateInode (
 
   Inode = AllocateZeroPool (InodeSize);
 
-  if (!Inode) {
+  if (Inode == NULL) {
     return NULL;
   }
 
-- 
2.39.1

[edk2-platforms][PATCH v4 09/12] Ext4Pkg: Add missing exit Status in Ext4OpenDirent

[Savva Mitrofanov]

Missing EFI_OUT_OF_RESOURCES exit status on failed Ext4CreateDentry
leads to NULL-pointer dereference in Ext4GetFileInfo (passing NULL
buffer in Ext4ReadDir)

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: 21b1853880d5 ("Ext4Pkg: Add a directory entry tree.")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Directory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Directory.c b/Features/Ext4Pkg/Ext4Dxe/Directory.c
index c7992cc72717..dee8cfc66cb7 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Directory.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Directory.c
@@ -267,7 +267,8 @@ Ext4OpenDirent (
   } else {
     File->Dentry = Ext4CreateDentry (FileName, Directory->Dentry);
 
-    if (!File->Dentry) {
+    if (File->Dentry == NULL) {
+      Status = EFI_OUT_OF_RESOURCES;
       goto Error;
     }
   }
-- 
2.39.1

[edk2-platforms][PATCH v4 10/12] Ext4Pkg: Fixes build on MSVC

[Savva Mitrofanov]

Accessing array using index of uint64 type makes MSVC compiler to
include `__allmul` function in NOOPT which is not referenced in IA32.
So we null-terminates string using ReadSize, which should be equal to
SymlinkSizeTmp after correct reading. Also adds missing MultU64x32
in Ext4Read.

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: 7c46116b0e18 ("Ext4Pkg: Add ext2/3 support")
Fixes: e81432fbacb7 ("Ext4Pkg: Add symbolic links support")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Inode.c   |  4 ++--
 Features/Ext4Pkg/Ext4Dxe/Symlink.c | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Inode.c b/Features/Ext4Pkg/Ext4Dxe/Inode.c
index 90e3eb88f523..8db051d3c444 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Inode.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Inode.c
@@ -152,7 +152,7 @@ Ext4Read (
       } else {
         // Uninitialized extents behave exactly the same as file holes, except they have
         // blocks already allocated to them.
-        HoleLen = (Ext4GetExtentLength (&Extent) * Partition->BlockSize) - HoleOff;
+        HoleLen = MultU64x32 (Ext4GetExtentLength (&Extent), Partition->BlockSize) - HoleOff;
       }
 
       WasRead = HoleLen > RemainingRead ? RemainingRead : (UINTN)HoleLen;
@@ -166,7 +166,7 @@ Ext4Read (
                            Partition->BlockSize
                            );
       ExtentLengthBytes  = Extent.ee_len * Partition->BlockSize;
-      ExtentLogicalBytes = (UINT64)Extent.ee_block * Partition->BlockSize;
+      ExtentLogicalBytes = MultU64x32 ((UINT64)Extent.ee_block, Partition->BlockSize);
       ExtentOffset       = CurrentSeek - ExtentLogicalBytes;
       ExtentMayRead      = (UINTN)(ExtentLengthBytes - ExtentOffset);
 
diff --git a/Features/Ext4Pkg/Ext4Dxe/Symlink.c b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
index 19b357ac6ba0..8b1511a38b55 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Symlink.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
@@ -1,7 +1,7 @@
 /** @file
   Symbolic links routines
 
-  Copyright (c) 2022 Savva Mitrofanov All rights reserved.
+  Copyright (c) 2022-2023 Savva Mitrofanov All rights reserved.
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
 
@@ -155,11 +155,6 @@ Ext4ReadSlowSymlink (
     return Status;
   }
 
-  //
-  // Add null-terminator
-  //
-  SymlinkTmp[SymlinkSizeTmp] = '\0';
-
   if (SymlinkSizeTmp != ReadSize) {
     DEBUG ((
       DEBUG_FS,
@@ -168,6 +163,11 @@ Ext4ReadSlowSymlink (
     return EFI_VOLUME_CORRUPTED;
   }
 
+  //
+  // Add null-terminator
+  //
+  SymlinkTmp[ReadSize] = '\0';
+
   *AsciiSymlinkSize = SymlinkAllocateSize;
   *AsciiSymlink     = SymlinkTmp;
 
-- 
2.39.1

[edk2-platforms][PATCH v4 11/12] Ext4Pkg: Filter out directory entry names containing \0 as invalid

[Savva Mitrofanov]

The directory entry name conventions forbid having null-terminator
symbols in its body and can lead to undefined behavior conditions
and crashes

Cc: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: 89b2bb0db263 ("Ext4Pkg: Fix and clarify handling regarding non-utf8 dir entries")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
---
 Features/Ext4Pkg/Ext4Dxe/Directory.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Directory.c b/Features/Ext4Pkg/Ext4Dxe/Directory.c
index dee8cfc66cb7..88f89a40534c 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Directory.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Directory.c
@@ -28,9 +28,16 @@ Ext4GetUcs2DirentName (
 {
   CHAR8       Utf8NameBuf[EXT4_NAME_MAX + 1];
   UINT16      *Str;
+  UINT8       Index;
   EFI_STATUS  Status;
 
-  CopyMem (Utf8NameBuf, Entry->name, Entry->name_len);
+  for (Index = 0; Index < Entry->name_len; ++Index) {
+    if (Entry->name[Index] == '\0') {
+      return EFI_INVALID_PARAMETER;
+    }
+
+    Utf8NameBuf[Index] = Entry->name[Index];
+  }
 
   Utf8NameBuf[Entry->name_len] = '\0';
 
-- 
2.39.1

[edk2-platforms][PATCH v4 12/12] Ext4Pkg: Corrects memory leak in Ext4ReadSlowSymlink

[Savva Mitrofanov]

We need to free SymlinkTmp before exiting if SymlinkSizeTmp != ReadSize
condition is true

Reported-by: Marvin Häuser <mhaeuser@posteo.de>
Cc: Pedro Falcato <pedro.falcato@gmail.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Fixes: e81432fbacb7 ("Ext4Pkg: Add symbolic links support")
Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
---
 Features/Ext4Pkg/Ext4Dxe/Symlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Features/Ext4Pkg/Ext4Dxe/Symlink.c b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
index 8b1511a38b55..1189a99ded2b 100644
--- a/Features/Ext4Pkg/Ext4Dxe/Symlink.c
+++ b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
@@ -160,6 +160,7 @@ Ext4ReadSlowSymlink (
       DEBUG_FS,
       "[ext4] Error! The size of the read block doesn't match the value from the inode!\n"
       ));
+    FreePool (SymlinkTmp);
     return EFI_VOLUME_CORRUPTED;
   }
 
-- 
2.39.1

Re: [edk2-platforms][PATCH v4 12/12] Ext4Pkg: Corrects memory leak in Ext4ReadSlowSymlink

[Marvin Häuser]

Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>

> On 2. Feb 2023, at 11:21, Savva Mitrofanov <savvamtr@gmail.com> wrote:
> 
> We need to free SymlinkTmp before exiting if SymlinkSizeTmp != ReadSize
> condition is true
> 
> Reported-by: Marvin Häuser <mhaeuser@posteo.de>
> Cc: Pedro Falcato <pedro.falcato@gmail.com>
> Cc: Vitaly Cheptsov <vit9696@protonmail.com>
> Fixes: e81432fbacb7 ("Ext4Pkg: Add symbolic links support")
> Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
> Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>
> ---
> Features/Ext4Pkg/Ext4Dxe/Symlink.c | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/Features/Ext4Pkg/Ext4Dxe/Symlink.c b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
> index 8b1511a38b55..1189a99ded2b 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/Symlink.c
> +++ b/Features/Ext4Pkg/Ext4Dxe/Symlink.c
> @@ -160,6 +160,7 @@ Ext4ReadSlowSymlink (
>       DEBUG_FS,
>       "[ext4] Error! The size of the read block doesn't match the value from the inode!\n"
>       ));
> +    FreePool (SymlinkTmp);
>     return EFI_VOLUME_CORRUPTED;
>   }
> 
> -- 
> 2.39.1
> 

Re: [edk2-platforms][PATCH v4 11/12] Ext4Pkg: Filter out directory entry names containing \0 as invalid

[Marvin Häuser]

Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>

> On 2. Feb 2023, at 11:21, Savva Mitrofanov <savvamtr@gmail.com> wrote:
> 
> The directory entry name conventions forbid having null-terminator
> symbols in its body and can lead to undefined behavior conditions
> and crashes
> 
> Cc: Marvin Häuser <mhaeuser@posteo.de>
> Cc: Pedro Falcato <pedro.falcato@gmail.com>
> Cc: Vitaly Cheptsov <vit9696@protonmail.com>
> Fixes: 89b2bb0db263 ("Ext4Pkg: Fix and clarify handling regarding non-utf8 dir entries")
> Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
> Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>
> ---
> Features/Ext4Pkg/Ext4Dxe/Directory.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/Features/Ext4Pkg/Ext4Dxe/Directory.c b/Features/Ext4Pkg/Ext4Dxe/Directory.c
> index dee8cfc66cb7..88f89a40534c 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/Directory.c
> +++ b/Features/Ext4Pkg/Ext4Dxe/Directory.c
> @@ -28,9 +28,16 @@ Ext4GetUcs2DirentName (
> {
>   CHAR8       Utf8NameBuf[EXT4_NAME_MAX + 1];
>   UINT16      *Str;
> +  UINT8       Index;
>   EFI_STATUS  Status;
> 
> -  CopyMem (Utf8NameBuf, Entry->name, Entry->name_len);
> +  for (Index = 0; Index < Entry->name_len; ++Index) {
> +    if (Entry->name[Index] == '\0') {
> +      return EFI_INVALID_PARAMETER;
> +    }
> +
> +    Utf8NameBuf[Index] = Entry->name[Index];
> +  }
> 
>   Utf8NameBuf[Entry->name_len] = '\0';
> 
> -- 
> 2.39.1
> 

Re: [edk2-platforms][PATCH v4 06/12] Ext4Pkg: Corrects integer overflow check logic in DiskUtil

[Marvin Häuser]

Reviewed-by: Marvin Häuser <mhaeuser@posteo.de>

> On 2. Feb 2023, at 11:21, Savva Mitrofanov <savvamtr@gmail.com> wrote:
> 
> Corrects multiplication overflow check code and adds additional check
> for emptiness of number of blocks and block number
> 
> Cc: Marvin Häuser <mhaeuser@posteo.de>
> Cc: Pedro Falcato <pedro.falcato@gmail.com>
> Cc: Vitaly Cheptsov <vit9696@protonmail.com>
> Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
> Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
> ---
> Features/Ext4Pkg/Ext4Pkg.dsc        |  2 +-
> Features/Ext4Pkg/Ext4Dxe/DiskUtil.c | 18 ++++++++++++++----
> Features/Ext4Pkg/Ext4Dxe/Extents.c  | 15 ++++++++++++---
> 3 files changed, 27 insertions(+), 8 deletions(-)
> 
> diff --git a/Features/Ext4Pkg/Ext4Pkg.dsc b/Features/Ext4Pkg/Ext4Pkg.dsc
> index 59bc327ebf6e..621c63eaf92d 100644
> --- a/Features/Ext4Pkg/Ext4Pkg.dsc
> +++ b/Features/Ext4Pkg/Ext4Pkg.dsc
> @@ -46,7 +46,7 @@
>   DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
>   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf
>   BaseUcs2Utf8Lib|RedfishPkg/Library/BaseUcs2Utf8Lib/BaseUcs2Utf8Lib.inf
> -  
> +
>   #
>   # Required for stack protector support
>   #
> diff --git a/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c b/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
> index 32da35f7d9f5..5df9ce5bafcf 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
> +++ b/Features/Ext4Pkg/Ext4Dxe/DiskUtil.c
> @@ -54,17 +54,20 @@ Ext4ReadBlocks (
>   UINT64  Offset;
>   UINTN   Length;
> 
> +  ASSERT (NumberBlocks != 0);
> +  ASSERT (BlockNumber != EXT4_BLOCK_FILE_HOLE);
> +
>   Offset = MultU64x32 (BlockNumber, Partition->BlockSize);
>   Length = NumberBlocks * Partition->BlockSize;
> 
>   // Check for overflow on the block -> byte conversions.
>   // Partition->BlockSize is never 0, so we don't need to check for that.
> 
> -  if (Offset > DivU64x32 ((UINT64)-1, Partition->BlockSize)) {
> +  if (DivU64x64Remainder (Offset, BlockNumber, NULL) != Partition->BlockSize) {
>     return EFI_INVALID_PARAMETER;
>   }
> 
> -  if (Length > (UINTN)-1/Partition->BlockSize) {
> +  if (Length / NumberBlocks != Partition->BlockSize) {
>     return EFI_INVALID_PARAMETER;
>   }
> 
> @@ -92,14 +95,21 @@ Ext4AllocAndReadBlocks (
>   VOID   *Buf;
>   UINTN  Length;
> 
> +  // Check that number of blocks isn't empty, because
> +  // this is incorrect condition for opened partition,
> +  // so we just early-exit
> +  if ((NumberBlocks == 0) || (BlockNumber == EXT4_BLOCK_FILE_HOLE)) {
> +    return NULL;
> +  }
> +
>   Length = NumberBlocks * Partition->BlockSize;
> 
> -  if (Length > (UINTN)-1/Partition->BlockSize) {
> +  // Check for integer overflow
> +  if (Length / NumberBlocks != Partition->BlockSize) {
>     return NULL;
>   }
> 
>   Buf = AllocatePool (Length);
> -
>   if (Buf == NULL) {
>     return NULL;
>   }
> diff --git a/Features/Ext4Pkg/Ext4Dxe/Extents.c b/Features/Ext4Pkg/Ext4Dxe/Extents.c
> index e1001d0a4292..99cb0f204fc2 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/Extents.c
> +++ b/Features/Ext4Pkg/Ext4Dxe/Extents.c
> @@ -237,6 +237,7 @@ Ext4GetExtent (
>   EXT4_EXTENT_HEADER  *ExtHeader;
>   EXT4_EXTENT_INDEX   *Index;
>   EFI_STATUS          Status;
> +  EXT4_BLOCK_NR       BlockNumber;
> 
>   Inode  = File->Inode;
>   Ext    = NULL;
> @@ -288,7 +289,16 @@ Ext4GetExtent (
>     // Therefore, we can use binary search, and it's actually the standard for doing so
>     // (see FreeBSD).
> 
> -    Index = Ext4BinsearchExtentIndex (ExtHeader, LogicalBlock);
> +    Index       = Ext4BinsearchExtentIndex (ExtHeader, LogicalBlock);
> +    BlockNumber = Ext4ExtentIdxLeafBlock (Index);
> +
> +    // Check that block isn't file hole
> +    if (BlockNumber == EXT4_BLOCK_FILE_HOLE) {
> +      if (Buffer != NULL) {
> +        FreePool (Buffer);
> +      }
> +      return EFI_NO_MAPPING;
> +    }
> 
>     if (Buffer == NULL) {
>       Buffer = AllocatePool (Partition->BlockSize);
> @@ -298,8 +308,7 @@ Ext4GetExtent (
>     }
> 
>     // Read the leaf block onto the previously-allocated buffer.
> -
> -    Status = Ext4ReadBlocks (Partition, Buffer, 1, Ext4ExtentIdxLeafBlock (Index));
> +    Status = Ext4ReadBlocks (Partition, Buffer, 1, BlockNumber);
>     if (EFI_ERROR (Status)) {
>       FreePool (Buffer);
>       return Status;
> -- 
> 2.39.1
> 

Re: [edk2-platforms][PATCH v4 04/12] Ext4Pkg: Add inode number validity check

[Marvin Häuser]

Acked-by: Marvin Häuser <mhaeuser@posteo.de>

> On 2. Feb 2023, at 11:21, Savva Mitrofanov <savvamtr@gmail.com> wrote:
> 
> We need to validate inode number to prevent reading non-existent and
> incorrect inodes so we checks that inode number valid across opened
> partition before we read it in Ext4ReadInode.
> 
> Cc: Marvin Häuser <mhaeuser@posteo.de>
> Cc: Pedro Falcato <pedro.falcato@gmail.com>
> Cc: Vitaly Cheptsov <vit9696@protonmail.com>
> Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.")
> Signed-off-by: Savva Mitrofanov <savvamtr@gmail.com>
> ---
> Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h   | 13 +++++++++++--
> Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h    | 12 ++++++++++++
> Features/Ext4Pkg/Ext4Dxe/BlockGroup.c |  5 +++++
> 3 files changed, 28 insertions(+), 2 deletions(-)
> 
> diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h b/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
> index d0a455d0e572..70cb6c3209dd 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
> +++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h
> @@ -484,8 +484,17 @@ typedef UINT64  EXT4_BLOCK_NR;
> typedef UINT32  EXT2_BLOCK_NR;
> typedef UINT32  EXT4_INO_NR;
> 
> -// 2 is always the root inode number in ext4
> -#define EXT4_ROOT_INODE_NR  2
> +/* Special inode numbers */
> +#define EXT4_ROOT_INODE_NR         2
> +#define EXT4_USR_QUOTA_INODE_NR    3
> +#define EXT4_GRP_QUOTA_INODE_NR    4
> +#define EXT4_BOOT_LOADER_INODE_NR  5
> +#define EXT4_UNDEL_DIR_INODE_NR    6
> +#define EXT4_RESIZE_INODE_NR       7
> +#define EXT4_JOURNAL_INODE_NR      8
> +
> +/* First non-reserved inode for old ext4 filesystems */
> +#define EXT4_GOOD_OLD_FIRST_INODE_NR  11
> 
> #define EXT4_BLOCK_FILE_HOLE  0
> 
> diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
> index f608def7c9eb..c977a97ca5c2 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
> +++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h
> @@ -287,6 +287,18 @@ Ext4GetBlockGroupDesc (
>   IN UINT32          BlockGroup
>   );
> 
> +/**
> +   Checks inode number validity across superblock of the opened partition.
> +   Currently we don't have logic to process defective blocks with
> +   inode number equal 1, so we don't reject them at this point
> +
> +   @param[in]  Partition      Pointer to the opened ext4 partition.
> +
> +   @return TRUE if inode number is valid.
> +**/
> +#define EXT4_IS_VALID_INODE_NR(Partition, InodeNum)                            \
> +  (((InodeNum) > 0) && (InodeNum) <= (Partition->SuperBlock.s_inodes_count))
> +
> /**
>    Reads an inode from disk.
> 
> diff --git a/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c b/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
> index cba96cd95afc..f34cdc5dbad7 100644
> --- a/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
> +++ b/Features/Ext4Pkg/Ext4Dxe/BlockGroup.c
> @@ -50,6 +50,11 @@ Ext4ReadInode (
>   EXT4_BLOCK_NR          InodeTableStart;
>   EFI_STATUS             Status;
> 
> +  if (!EXT4_IS_VALID_INODE_NR (Partition, InodeNum)) {
> +    DEBUG ((DEBUG_ERROR, "[ext4] Error reading inode: inode number %lu isn't valid\n", InodeNum));
> +    return EFI_VOLUME_CORRUPTED;
> +  }
> +
>   BlockGroupNumber = (UINT32)DivU64x64Remainder (
>                                InodeNum - 1,
>                                Partition->SuperBlock.s_inodes_per_group,
> -- 
> 2.39.1
> 

Re: [edk2-platforms][PATCH v4 00/12] Ext4Pkg: Code correctness and security improvements

[Pedro Falcato]

With some minor fixups[1], for the series:

Reviewed-by: Pedro Falcato <pedro.falcato@gmail.com>

and pushed to edk2-platforms HEAD.

Thanks,

Pedro

[1] Fixed up some commit messages to be imperative, added my Rb, fixed
a status return in Extents.c for ("Ext4Pkg: Correct integer overflow
check logic in DiskUtil"), and removed a comment wrt ("Ext4Pkg: Add
inode number validity check"); you misinterpreted what I told you
off-list, I meant that we shouldn't judge what operating systems put
as inodes as long as it doesn't jeopardize the driver and it's
correctness - so doing > 0 is good, banning 1 for no reason is not -
this doesn't mean we're going to start using inode 1 any time soon.

On Thu, Feb 2, 2023 at 10:21 AM Savva Mitrofanov <savvamtr@gmail.com> wrote:
>
> Hi all,
>
> In v4 I rebased patches according upstream. Also in this revision I corrected
> all remarks and comments from v3.
>
> This patchset fixes several code problems found by fuzzing Ext4Dxe like
> buffer and integer overflows, memory leaks, logic bugs and so on.
>
> REF: https://github.com/savvamitrofanov/edk2-platforms/tree/master
>
> Cc: Marvin Häuser <mhaeuser@posteo.de>
> Cc: Pedro Falcato <pedro.falcato@gmail.com>
> Cc: Vitaly Cheptsov <vit9696@protonmail.com>
>
> Savva Mitrofanov (12):
>   Ext4Pkg: Fix memory leak in Ext4RetrieveDirent
>   Ext4Pkg: Fix incorrect checksum metadata feature check
>   Ext4Pkg: Fix division by zero by adding check for s_inodes_per_group
>   Ext4Pkg: Add inode number validity check
>   Ext4Pkg: Fix shift out of bounds in Ext4OpenSuperblock
>   Ext4Pkg: Corrects integer overflow check logic in DiskUtil
>   Ext4Pkg: Check that source file is directory in Ext4OpenInternal
>   Ext4Pkg: Check VolumeName allocation correctness in Ext4GetVolumeName
>   Ext4Pkg: Add missing exit Status in Ext4OpenDirent
>   Ext4Pkg: Fixes build on MSVC
>   Ext4Pkg: Filter out directory entry names containing \0 as invalid
>   Ext4Pkg: Corrects memory leak in Ext4ReadSlowSymlink
>
>  Features/Ext4Pkg/Ext4Pkg.dsc          |  2 +-
>  Features/Ext4Pkg/Ext4Dxe/Ext4Disk.h   | 13 +++++-
>  Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h    | 26 ++++++++++++
>  Features/Ext4Pkg/Ext4Dxe/BlockGroup.c |  5 +++
>  Features/Ext4Pkg/Ext4Dxe/Directory.c  | 42 ++++++++++++--------
>  Features/Ext4Pkg/Ext4Dxe/DiskUtil.c   | 18 +++++++--
>  Features/Ext4Pkg/Ext4Dxe/Extents.c    | 15 +++++--
>  Features/Ext4Pkg/Ext4Dxe/File.c       | 23 ++++++++---
>  Features/Ext4Pkg/Ext4Dxe/Inode.c      |  6 +--
>  Features/Ext4Pkg/Ext4Dxe/Superblock.c | 16 ++++++--
>  Features/Ext4Pkg/Ext4Dxe/Symlink.c    | 13 +++---
>  11 files changed, 134 insertions(+), 45 deletions(-)
>
> --
> 2.39.1
>


-- 
Pedro