lkml.org 
[lkml]   [2009]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 34/36] ext4: Add sanity check to make_indexed_dir
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: "Theodore Ts'o" <tytso@mit.edu>

    (cherry picked from commit e6b8bc09ba2075cd91fbffefcd2778b1a00bd76f)

    Make sure the rec_len field in the '..' entry is sane, lest we overrun
    the directory block and cause a kernel oops on a purposefully
    corrupted filesystem.

    Thanks to Sami Liedes for reporting this bug.

    http://bugzilla.kernel.org/show_bug.cgi?id=12430

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/ext4/namei.c | 21 +++++++++++++++------
    1 file changed, 15 insertions(+), 6 deletions(-)
    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -1382,7 +1382,7 @@ static int make_indexed_dir(handle_t *ha
    struct fake_dirent *fde;

    blocksize = dir->i_sb->s_blocksize;
    - dxtrace(printk("Creating index\n"));
    + dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
    retval = ext4_journal_get_write_access(handle, bh);
    if (retval) {
    ext4_std_error(dir->i_sb, retval);
    @@ -1391,6 +1391,20 @@ static int make_indexed_dir(handle_t *ha
    }
    root = (struct dx_root *) bh->b_data;

    + /* The 0th block becomes the root, move the dirents out */
    + fde = &root->dotdot;
    + de = (struct ext4_dir_entry_2 *)((char *)fde +
    + ext4_rec_len_from_disk(fde->rec_len));
    + if ((char *) de >= (((char *) root) + blocksize)) {
    + ext4_error(dir->i_sb, __func__,
    + "invalid rec_len for '..' in inode %lu",
    + dir->i_ino);
    + brelse(bh);
    + return -EIO;
    + }
    + len = ((char *) root) + blocksize - (char *) de;
    +
    + /* Allocate new block for the 0th block's dirents */
    bh2 = ext4_append (handle, dir, &block, &retval);
    if (!(bh2)) {
    brelse(bh);
    @@ -1399,11 +1413,6 @@ static int make_indexed_dir(handle_t *ha
    EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
    data1 = bh2->b_data;

    - /* The 0th block becomes the root, move the dirents out */
    - fde = &root->dotdot;
    - de = (struct ext4_dir_entry_2 *)((char *)fde +
    - ext4_rec_len_from_disk(fde->rec_len));
    - len = ((char *) root) + blocksize - (char *) de;
    memcpy (data1, de, len);
    de = (struct ext4_dir_entry_2 *) data1;
    top = data1 + len;


    \
     
     \ /
      Last update: 2009-02-18 23:47    [W:0.729 / U:0.880 seconds]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean