hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert "staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()" 

This reverts commit d4104c5e78.

Turns out it still needs some more work, I merged it to soon :(

Reported-by: Gao Xiang <gaoxiang25@huawei.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Greg Kroah-Hartman 2019-01-30 19:17:53 +01:00
parent d4104c5e78
commit 798badf846
1 changed files with 78 additions and 89 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

167
drivers/staging/erofs/namei.c
View File

@ -15,76 +15,74 @@
#include <trace/events/erofs.h> #include <trace/events/erofs.h>
struct erofs_qstr { /* based on the value of qn->len is accurate */
const unsigned char *name; static inline int dirnamecmp(struct qstr *qn,
const unsigned char *end; struct qstr *qd, unsigned int *matched)
};
/* based on the end of qn is accurate and it must have the trailing '\0' */
static inline int dirnamecmp(const struct erofs_qstr *qn,
const struct erofs_qstr *qd,
unsigned int *matched)
{ {
unsigned int i = *matched; unsigned int i = *matched, len = min(qn->len, qd->len);
loop:
/* if (unlikely(i >= len)) {
* on-disk error, let's only BUG_ON in the debugging mode. *matched = i;
* otherwise, it will return 1 to just skip the invalid name if (qn->len < qd->len) {
* and go on (in consideration of the lookup performance). /*
*/ * actually (qn->len == qd->len)
DBG_BUGON(qd->name > qd->end); * when qd->name[i] == '\0'
*/
/* qd could not have trailing '\0' */ return qd->name[i] == '\0' ? 0 : -1;
/* However it is absolutely safe if < qd->end */
while (qd->name + i < qd->end && qd->name[i] != '\0') {
if (qn->name[i] != qd->name[i]) {
*matched = i;
return qn->name[i] > qd->name[i] ? 1 : -1;
} }
++i; return (qn->len > qd->len);
} }
*matched = i;
/* See comments in __d_alloc on the terminating NUL character */ if (qn->name[i] != qd->name[i]) {
return qn->name[i] == '\0' ? 0 : 1; *matched = i;
return qn->name[i] > qd->name[i] ? 1 : -1;
}
++i;
goto loop;
} }
#define nameoff_from_disk(off, sz) (le16_to_cpu(off) & ((sz) - 1)) static struct erofs_dirent *find_target_dirent(
struct qstr *name,
static struct erofs_dirent *find_target_dirent(struct erofs_qstr *name, u8 *data, int maxsize)
u8 *data,
unsigned int dirblksize,
const int ndirents)
{ {
int head, back; unsigned int ndirents, head, back;
unsigned int startprfx, endprfx; unsigned int startprfx, endprfx;
struct erofs_dirent *const de = (struct erofs_dirent *)data; struct erofs_dirent *const de = (struct erofs_dirent *)data;
/* make sure that maxsize is valid */
BUG_ON(maxsize < sizeof(struct erofs_dirent));
ndirents = le16_to_cpu(de->nameoff) / sizeof(*de);
/* corrupted dir (may be unnecessary...) */
BUG_ON(!ndirents);
head = 0; head = 0;
back = ndirents - 1; back = ndirents - 1;
startprfx = endprfx = 0; startprfx = endprfx = 0;
while (head <= back) { while (head <= back) {
const int mid = head + (back - head) / 2; unsigned int mid = head + (back - head) / 2;
const int nameoff = nameoff_from_disk(de[mid].nameoff, unsigned int nameoff = le16_to_cpu(de[mid].nameoff);
dirblksize);
unsigned int matched = min(startprfx, endprfx); unsigned int matched = min(startprfx, endprfx);
struct erofs_qstr dname = {
.name = data + nameoff, struct qstr dname = QSTR_INIT(data + nameoff,
.end = unlikely(mid >= ndirents - 1) ? unlikely(mid >= ndirents - 1) ?
data + dirblksize : maxsize - nameoff :
data + nameoff_from_disk(de[mid + 1].nameoff, le16_to_cpu(de[mid + 1].nameoff) - nameoff);
dirblksize)
};
/* string comparison without already matched prefix */ /* string comparison without already matched prefix */
int ret = dirnamecmp(name, &dname, &matched); int ret = dirnamecmp(name, &dname, &matched);
if (unlikely(!ret)) { if (unlikely(!ret))
return de + mid; return de + mid;
} else if (ret > 0) { else if (ret > 0) {
head = mid + 1; head = mid + 1;
startprfx = matched; startprfx = matched;
} else { } else if (unlikely(mid < 1)) /* fix "mid" overflow */
break;
else {
back = mid - 1; back = mid - 1;
endprfx = matched; endprfx = matched;
} }
@ -93,13 +91,12 @@ static struct erofs_dirent *find_target_dirent(struct erofs_qstr *name,
return ERR_PTR(-ENOENT); return ERR_PTR(-ENOENT);
} }
static struct page *find_target_block_classic(struct inode *dir, static struct page *find_target_block_classic(
struct erofs_qstr *name, struct inode *dir,
int *_diff, struct qstr *name, int *_diff)
int *_ndirents)
{ {
unsigned int startprfx, endprfx; unsigned int startprfx, endprfx;
int head, back; unsigned int head, back;
struct address_space *const mapping = dir->i_mapping; struct address_space *const mapping = dir->i_mapping;
struct page *candidate = ERR_PTR(-ENOENT); struct page *candidate = ERR_PTR(-ENOENT);
@ -108,34 +105,33 @@ static struct page *find_target_block_classic(struct inode *dir,
back = inode_datablocks(dir) - 1; back = inode_datablocks(dir) - 1;
while (head <= back) { while (head <= back) {
const int mid = head + (back - head) / 2; unsigned int mid = head + (back - head) / 2;
struct page *page = read_mapping_page(mapping, mid, NULL); struct page *page = read_mapping_page(mapping, mid, NULL);
if (!IS_ERR(page)) { if (IS_ERR(page)) {
struct erofs_dirent *de = kmap_atomic(page); exact_out:
const int nameoff = nameoff_from_disk(de->nameoff, if (!IS_ERR(candidate)) /* valid candidate */
EROFS_BLKSIZ); put_page(candidate);
const int ndirents = nameoff / sizeof(*de); return page;
} else {
int diff; int diff;
unsigned int matched; unsigned int ndirents, matched;
struct erofs_qstr dname; struct qstr dname;
struct erofs_dirent *de = kmap_atomic(page);
unsigned int nameoff = le16_to_cpu(de->nameoff);
if (unlikely(!ndirents)) { ndirents = nameoff / sizeof(*de);
DBG_BUGON(1);
put_page(page); /* corrupted dir (should have one entry at least) */
page = ERR_PTR(-EIO); BUG_ON(!ndirents || nameoff > PAGE_SIZE);
goto out;
}
matched = min(startprfx, endprfx); matched = min(startprfx, endprfx);
dname.name = (u8 *)de + nameoff; dname.name = (u8 *)de + nameoff;
if (ndirents == 1) dname.len = ndirents == 1 ?
dname.end = (u8 *)de + EROFS_BLKSIZ; /* since the rest of the last page is 0 */
else EROFS_BLKSIZ - nameoff
dname.end = (u8 *)de + : le16_to_cpu(de[1].nameoff) - nameoff;
nameoff_from_disk(de[1].nameoff,
EROFS_BLKSIZ);
/* string comparison without already matched prefix */ /* string comparison without already matched prefix */
diff = dirnamecmp(name, &dname, &matched); diff = dirnamecmp(name, &dname, &matched);
@ -143,7 +139,7 @@ static struct page *find_target_block_classic(struct inode *dir,
if (unlikely(!diff)) { if (unlikely(!diff)) {
*_diff = 0; *_diff = 0;
goto out; goto exact_out;
} else if (diff > 0) { } else if (diff > 0) {
head = mid + 1; head = mid + 1;
startprfx = matched; startprfx = matched;
@ -151,42 +147,35 @@ static struct page *find_target_block_classic(struct inode *dir,
if (likely(!IS_ERR(candidate))) if (likely(!IS_ERR(candidate)))
put_page(candidate); put_page(candidate);
candidate = page; candidate = page;
*_ndirents = ndirents;
} else { } else {
put_page(page); put_page(page);
if (unlikely(mid < 1)) /* fix "mid" overflow */
break;
back = mid - 1; back = mid - 1;
endprfx = matched; endprfx = matched;
} }
continue;
} }
out: /* free if the candidate is valid */
if (!IS_ERR(candidate))
put_page(candidate);
return page;
} }
*_diff = 1; *_diff = 1;
return candidate; return candidate;
} }
int erofs_namei(struct inode *dir, int erofs_namei(struct inode *dir,
struct qstr *name, struct qstr *name,
erofs_nid_t *nid, unsigned int *d_type) erofs_nid_t *nid, unsigned int *d_type)
{ {
int diff, ndirents; int diff;
struct page *page; struct page *page;
u8 *data; u8 *data;
struct erofs_dirent *de; struct erofs_dirent *de;
struct erofs_qstr qn;
if (unlikely(!dir->i_size)) if (unlikely(!dir->i_size))
return -ENOENT; return -ENOENT;
qn.name = name->name;
qn.end = name->name + name->len;
diff = 1; diff = 1;
page = find_target_block_classic(dir, &qn, &diff, &ndirents); page = find_target_block_classic(dir, name, &diff);
if (unlikely(IS_ERR(page))) if (unlikely(IS_ERR(page)))
return PTR_ERR(page); return PTR_ERR(page);
@ -195,7 +184,7 @@ int erofs_namei(struct inode *dir,
/* the target page has been mapped */ /* the target page has been mapped */
de = likely(diff) ? de = likely(diff) ?
/* since the rest of the last page is 0 */ /* since the rest of the last page is 0 */
find_target_dirent(&qn, data, EROFS_BLKSIZ, ndirents) : find_target_dirent(name, data, EROFS_BLKSIZ) :
(struct erofs_dirent *)data; (struct erofs_dirent *)data;
if (likely(!IS_ERR(de))) { if (likely(!IS_ERR(de))) {