lkml.org 
[lkml]   [2020]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 013/212] f2fs: check memory boundary by insane namelen
    Date
    From: Jaegeuk Kim <jaegeuk@kernel.org>

    [ Upstream commit 4e240d1bab1ead280ddf5eb05058dba6bbd57d10 ]

    If namelen is corrupted to have very long value, fill_dentries can copy
    wrong memory area.

    Reviewed-by: Chao Yu <yuchao0@huawei.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/f2fs/dir.c | 11 ++++++++++-
    1 file changed, 10 insertions(+), 1 deletion(-)

    diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
    index b414892be08b7..79d138756acb5 100644
    --- a/fs/f2fs/dir.c
    +++ b/fs/f2fs/dir.c
    @@ -843,6 +843,16 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
    de_name.name = d->filename[bit_pos];
    de_name.len = le16_to_cpu(de->name_len);

    + /* check memory boundary before moving forward */
    + bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
    + if (unlikely(bit_pos > d->max)) {
    + f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING,
    + "%s: corrupted namelen=%d, run fsck to fix.",
    + __func__, le16_to_cpu(de->name_len));
    + set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK);
    + return -EINVAL;
    + }
    +
    if (f2fs_encrypted_inode(d->inode)) {
    int save_len = fstr->len;
    int err;
    @@ -861,7 +871,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
    le32_to_cpu(de->ino), d_type))
    return true;

    - bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
    ctx->pos = start_pos + bit_pos;
    }
    return false;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-20 11:57    [W:4.099 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site