korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-17 09:14:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

ext4: avoid cycles in directory h-tree

Browse Source 
commit 3ba733f879 upstream.

A maliciously corrupted filesystem can contain cycles in the h-tree
stored inside a directory. That can easily lead to the kernel corrupting
tree nodes that were already verified under its hands while doing a node
split and consequently accessing unallocated memory. Fix the problem by
verifying traversed block numbers are unique.

Cc: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jan Kara 2022-05-18 11:33:29 +02:00 committed by Greg Kroah-Hartman
parent ca17db3847
commit 3a3ce94164
1 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
fs/ext4/namei.c
View File

@ -777,12 +777,14 @@ static struct dx_frame *
dx_probe(struct ext4_filename *fname, struct inode *dir, dx_probe(struct ext4_filename *fname, struct inode *dir,
struct dx_hash_info *hinfo, struct dx_frame *frame_in) struct dx_hash_info *hinfo, struct dx_frame *frame_in)
{ {
unsigned count, indirect; unsigned count, indirect, level, i;
struct dx_entry *at, *entries, *p, *q, *m; struct dx_entry *at, *entries, *p, *q, *m;
struct dx_root *root; struct dx_root *root;
struct dx_frame *frame = frame_in; struct dx_frame *frame = frame_in;
struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR); struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR);
u32 hash; u32 hash;
ext4_lblk_t block;
ext4_lblk_t blocks[EXT4_HTREE_LEVEL];
memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0])); memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0]));
frame->bh = ext4_read_dirblock(dir, 0, INDEX); frame->bh = ext4_read_dirblock(dir, 0, INDEX);
@ -854,6 +856,8 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
} }
dxtrace(printk("Look up %x", hash)); dxtrace(printk("Look up %x", hash));
level = 0;
blocks[0] = 0;
while (1) { while (1) {
count = dx_get_count(entries); count = dx_get_count(entries);
if (!count || count > dx_get_limit(entries)) { if (!count || count > dx_get_limit(entries)) {
@ -882,15 +886,27 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
dx_get_block(at))); dx_get_block(at)));
frame->entries = entries; frame->entries = entries;
frame->at = at; frame->at = at;
if (!indirect--)
block = dx_get_block(at);
for (i = 0; i <= level; i++) {
if (blocks[i] == block) {
ext4_warning_inode(dir,
"dx entry: tree cycle block %u points back to block %u",
blocks[level], block);
goto fail;
}
}
if (++level > indirect)
return frame; return frame;
blocks[level] = block;
frame++; frame++;
frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX); frame->bh = ext4_read_dirblock(dir, block, INDEX);
if (IS_ERR(frame->bh)) { if (IS_ERR(frame->bh)) {
ret_err = (struct dx_frame *) frame->bh; ret_err = (struct dx_frame *) frame->bh;
frame->bh = NULL; frame->bh = NULL;
goto fail; goto fail;
} }
entries = ((struct dx_node *) frame->bh->b_data)->entries; entries = ((struct dx_node *) frame->bh->b_data)->entries;
if (dx_get_limit(entries) != dx_node_limit(dir)) { if (dx_get_limit(entries) != dx_node_limit(dir)) {