hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fat: validate ->i_start before using 

On corrupted FATfs may have invalid ->i_start.  To handle it, this checks
->i_start before using, and return proper error code.

Link: http://lkml.kernel.org/r/87o9f8y1t5.fsf_-_@mail.parknet.co.jp
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Tested-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Cc: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
OGAWA Hirofumi 2018-08-21 21:59:44 -07:00 committed by Linus Torvalds
parent f663b5b38f
commit 0afa962666
3 changed files with 20 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
fs/fat/cache.c
View File

@ -225,7 +225,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus)
int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
{ {
struct super_block *sb = inode->i_sb; struct super_block *sb = inode->i_sb;
const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits; struct msdos_sb_info *sbi = MSDOS_SB(sb);
const int limit = sb->s_maxbytes >> sbi->cluster_bits;
struct fat_entry fatent; struct fat_entry fatent;
struct fat_cache_id cid; struct fat_cache_id cid;
int nr; int nr;
@ -234,6 +235,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
*fclus = 0; *fclus = 0;
*dclus = MSDOS_I(inode)->i_start; *dclus = MSDOS_I(inode)->i_start;
if (!fat_valid_entry(sbi, *dclus)) {
fat_fs_error_ratelimit(sb,
"%s: invalid start cluster (i_pos %lld, start %08x)",
__func__, MSDOS_I(inode)->i_pos, *dclus);
return -EIO;
}
if (cluster == 0) if (cluster == 0)
return 0; return 0;
@ -250,9 +257,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
/* prevent the infinite loop of cluster chain */ /* prevent the infinite loop of cluster chain */
if (*fclus > limit) { if (*fclus > limit) {
fat_fs_error_ratelimit(sb, fat_fs_error_ratelimit(sb,
"%s: detected the cluster chain loop" "%s: detected the cluster chain loop (i_pos %lld)",
" (i_pos %lld)", __func__, __func__, MSDOS_I(inode)->i_pos);
MSDOS_I(inode)->i_pos);
nr = -EIO; nr = -EIO;
goto out; goto out;
} }
@ -262,9 +268,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
goto out; goto out;
else if (nr == FAT_ENT_FREE) { else if (nr == FAT_ENT_FREE) {
fat_fs_error_ratelimit(sb, fat_fs_error_ratelimit(sb,
"%s: invalid cluster chain (i_pos %lld)", "%s: invalid cluster chain (i_pos %lld)",
__func__, __func__, MSDOS_I(inode)->i_pos);
MSDOS_I(inode)->i_pos);
nr = -EIO; nr = -EIO;
goto out; goto out;
} else if (nr == FAT_ENT_EOF) { } else if (nr == FAT_ENT_EOF) {

5
fs/fat/fat.h
View File

@ -348,6 +348,11 @@ static inline void fatent_brelse(struct fat_entry *fatent)
fatent->fat_inode = NULL; fatent->fat_inode = NULL;
} }
static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry)
{
return FAT_START_ENT <= entry && entry < sbi->max_cluster;
}
extern void fat_ent_access_init(struct super_block *sb); extern void fat_ent_access_init(struct super_block *sb);
extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent, extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
int entry); int entry);

6
fs/fat/fatent.c
View File

@ -24,7 +24,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry,
{ {
struct msdos_sb_info *sbi = MSDOS_SB(sb); struct msdos_sb_info *sbi = MSDOS_SB(sb);
int bytes = entry + (entry >> 1); int bytes = entry + (entry >> 1);
WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); WARN_ON(!fat_valid_entry(sbi, entry));
*offset = bytes & (sb->s_blocksize - 1); *offset = bytes & (sb->s_blocksize - 1);
*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
} }
@ -34,7 +34,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry,
{ {
struct msdos_sb_info *sbi = MSDOS_SB(sb); struct msdos_sb_info *sbi = MSDOS_SB(sb);
int bytes = (entry << sbi->fatent_shift); int bytes = (entry << sbi->fatent_shift);
WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); WARN_ON(!fat_valid_entry(sbi, entry));
*offset = bytes & (sb->s_blocksize - 1); *offset = bytes & (sb->s_blocksize - 1);
*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
} }
@ -354,7 +354,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry)
int err, offset; int err, offset;
sector_t blocknr; sector_t blocknr;
if (entry < FAT_START_ENT || sbi->max_cluster <= entry) { if (!fat_valid_entry(sbi, entry)) {
fatent_brelse(fatent); fatent_brelse(fatent);
fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry); fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry);
return -EIO; return -EIO;