Phillip Lougher 434a964daa hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops ... Clement Lecigne reports a filesystem which causes a kernel oops in hfs_find_init() trying to dereference sb->ext_tree which is NULL. This proves to be because the filesystem has a corrupted MDB extent record, where the extents file does not fit into the first three extents in the file record (the first blocks). In hfs_get_block() when looking up the blocks for the extent file (HFS_EXT_CNID), it fails the first blocks special case, and falls through to the extent code (which ultimately calls hfs_find_init()) which is in the process of being initialised. Hfs avoids this scenario by always having the extents b-tree fitting into the first blocks (the extents B-tree can't have overflow extents). The fix is to check at mount time that the B-tree fits into first blocks, i.e. fail if HFS_I(inode)->alloc_blocks >= HFS_I(inode)->first_blocks Note, the existing commit 47f365eb57 ("hfs: fix oops on mount with corrupted btree extent records") becomes subsumed into this as a special case, but only for the extents B-tree (HFS_EXT_CNID), it is perfectly acceptable for the catalog B-Tree file to grow beyond three extents, with the remaining extent descriptors in the extents overfow. This fixes CVE-2011-2203 Reported-by: Clement LECIGNE <clement.lecigne@netasq.com> Signed-off-by: Phillip Lougher <plougher@redhat.com> Cc: Jeff Mahoney <jeffm@suse.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2011-11-02 16:06:59 -07:00
..
attr.c
bfind.c	hfs: Convert tree_lock to mutex	2010-10-12 17:36:11 +02:00
bitmap.c	hfs: convert bitmap_lock in a mutex	2008-07-25 10:53:33 -07:00
bnode.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
brec.c	hfs_bnode_find() can fail, resulting in hfs_bnode_split() breakage	2008-03-17 09:46:55 -07:00
btree.c	hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops	2011-11-02 16:06:59 -07:00
btree.h	hfs: Convert tree_lock to mutex	2010-10-12 17:36:11 +02:00
catalog.c	hfs: fix a potential buffer overflow	2009-12-15 08:53:10 -08:00
dir.c	hfs: remove unnecessary dentry_unhash on rmdir, dir rename	2011-05-28 01:02:52 -04:00
extent.c	hfs: convert extents_lock in a mutex	2008-07-25 10:53:33 -07:00
hfs_fs.h	fs: change d_hash for rcu-walk	2011-01-07 17:50:20 +11:00
hfs.h	address hfs on-disk corruption robustness review comments	2008-02-06 10:41:05 -08:00
inode.c	fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers	2011-07-20 20:47:59 -04:00
Kconfig	fs/Kconfig: move hfs, hfsplus out	2009-01-22 13:15:57 +03:00
Makefile
mdb.c	hfs: use sync_dirty_buffer	2010-10-25 21:18:21 -04:00
part_tbl.c
string.c	fs: change d_hash for rcu-walk	2011-01-07 17:50:20 +11:00
super.c	switch hfs	2011-01-12 20:02:45 -05:00
sysdep.c	fs: rcu-walk aware d_revalidate method	2011-01-07 17:50:29 +11:00
trans.c	[PATCH] hfs: NLS support	2005-09-07 16:57:50 -07:00