lkml.org 
[lkml]   [2007]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] ext2: skip pages past number of blocks in ext2_find_entry (CVE-2006-6054)
    This one looks like it fell through the cracks, it's in 2.6.19.2 but not upstream yet.

    thanks,
    -chris
    --
    Subject: [PATCH] ext2: skip pages past number of blocks in ext2_find_entry (CVE-2006-6054)
    From: Eric Sandeen <sandeen@redhat.com>

    This one was pointed out on the MOKB site:
    http://kernelfun.blogspot.com/2006/11/mokb-09-11-2006-linux-26x-ext2checkpage.html

    If a directory's i_size is corrupted, ext2_find_entry() will keep processing
    pages until the i_size is reached, even if there are no more blocks associated
    with the directory inode. This patch puts in some minimal sanity-checking
    so that we don't keep checking pages (and issuing errors) if we know there
    can be no more data to read, based on the block count of the directory inode.

    This is somewhat similar in approach to the ext3 patch I sent earlier this
    year.

    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    ---
    Not upstream yet

    fs/ext2/dir.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- linux-2.6.19.1.orig/fs/ext2/dir.c
    +++ linux-2.6.19.1/fs/ext2/dir.c
    @@ -368,6 +368,14 @@ struct ext2_dir_entry_2 * ext2_find_entr
    }
    if (++n >= npages)
    n = 0;
    + /* next page is past the blocks we've got */
    + if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) {
    + ext2_error(dir->i_sb, __FUNCTION__,
    + "dir %lu size %lld exceeds block count %llu",
    + dir->i_ino, dir->i_size,
    + (unsigned long long)dir->i_blocks);
    + goto out;
    + }
    } while (n != start);
    out:
    return NULL;
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2007-01-11 03:19    [W:0.022 / U:29.664 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site