hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ext4: fix ext4_empty_dir() for directories with holes 

Function ext4_empty_dir() doesn't correctly handle directories with
holes and crashes on bh->b_data dereference when bh is NULL. Reorganize
the loop to use 'offset' variable all the times instead of comparing
pointers to current direntry with bh->b_data pointer. Also add more
strict checking of '.' and '..' directory entries to avoid entering loop
in possibly invalid state on corrupted filesystems.

References: CVE-2019-19037
CC: stable@vger.kernel.org
Fixes: 4e19d6b65f ("ext4: allow directory holes")
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20191202170213.4761-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
Jan Kara 2019-12-02 18:02:12 +01:00 committed by Theodore Ts'o
parent dfdeeb41fb
commit 64d4ce8923
1 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
fs/ext4/namei.c
View File

@ -2822,7 +2822,7 @@ bool ext4_empty_dir(struct inode *inode)
{ {
unsigned int offset; unsigned int offset;
struct buffer_head *bh; struct buffer_head *bh;
struct ext4_dir_entry_2 *de, *de1; struct ext4_dir_entry_2 *de;
struct super_block *sb; struct super_block *sb;
if (ext4_has_inline_data(inode)) { if (ext4_has_inline_data(inode)) {
@ -2847,19 +2847,25 @@ bool ext4_empty_dir(struct inode *inode)
return true; return true;
de = (struct ext4_dir_entry_2 *) bh->b_data; de = (struct ext4_dir_entry_2 *) bh->b_data;
de1 = ext4_next_entry(de, sb->s_blocksize); if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size,
if (le32_to_cpu(de->inode) != inode->i_ino || 0) ||
le32_to_cpu(de1->inode) == 0 || le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) {
strcmp(".", de->name) || strcmp("..", de1->name)) { ext4_warning_inode(inode, "directory missing '.'");
ext4_warning_inode(inode, "directory missing '.' and/or '..'");
brelse(bh); brelse(bh);
return true; return true;
} }
offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); de = ext4_next_entry(de, sb->s_blocksize);
de = ext4_next_entry(de1, sb->s_blocksize); if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size,
offset) ||
le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
ext4_warning_inode(inode, "directory missing '..'");
brelse(bh);
return true;
}
offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
while (offset < inode->i_size) { while (offset < inode->i_size) {
if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { if (!(offset & (sb->s_blocksize - 1))) {
unsigned int lblock; unsigned int lblock;
brelse(bh); brelse(bh);
lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
@ -2870,12 +2876,11 @@ bool ext4_empty_dir(struct inode *inode)
} }
if (IS_ERR(bh)) if (IS_ERR(bh))
return true; return true;
de = (struct ext4_dir_entry_2 *) bh->b_data;
} }
de = (struct ext4_dir_entry_2 *) (bh->b_data +
(offset & (sb->s_blocksize - 1)));
if (ext4_check_dir_entry(inode, NULL, de, bh, if (ext4_check_dir_entry(inode, NULL, de, bh,
bh->b_data, bh->b_size, offset)) { bh->b_data, bh->b_size, offset)) {
de = (struct ext4_dir_entry_2 *)(bh->b_data +
sb->s_blocksize);
offset = (offset | (sb->s_blocksize - 1)) + 1; offset = (offset | (sb->s_blocksize - 1)) + 1;
continue; continue;
} }
@ -2884,7 +2889,6 @@ bool ext4_empty_dir(struct inode *inode)
return false; return false;
} }
offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
de = ext4_next_entry(de, sb->s_blocksize);
} }
brelse(bh); brelse(bh);
return true; return true;