lkml.org 
[lkml]   [2017]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: xfs: verify inline directory data forks
On Thu, Mar 16, 2017 at 8:35 PM, Linux Kernel Mailing List
<linux-kernel@vger.kernel.org> wrote:
> Web: https://git.kernel.org/torvalds/c/630a04e79dd41ff746b545d4fc052e0abb836120
> Commit: 630a04e79dd41ff746b545d4fc052e0abb836120
> Parent: 2fcc319d2467a5f5b78f35f79fd6e22741a31b1e
> Refname: refs/heads/master
> Author: Darrick J. Wong <darrick.wong@oracle.com>
> AuthorDate: Wed Mar 15 00:24:25 2017 -0700
> Committer: Darrick J. Wong <darrick.wong@oracle.com>
> CommitDate: Wed Mar 15 00:24:25 2017 -0700
>
> xfs: verify inline directory data forks
>
> When we're reading or writing the data fork of an inline directory,
> check the contents to make sure we're not overflowing buffers or eating
> garbage data. xfs/348 corrupts an inline symlink into an inline
> directory, triggering a buffer overflow bug.
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> Reviewed-by: Brian Foster <bfoster@redhat.com>

> --- a/fs/xfs/libxfs/xfs_dir2_sf.c
> +++ b/fs/xfs/libxfs/xfs_dir2_sf.c

> +/* Verify the consistency of an inline directory. */
> +int
> +xfs_dir2_sf_verify(
> + struct xfs_mount *mp,
> + struct xfs_dir2_sf_hdr *sfp,
> + int size)
> +{

> + /* Don't allow names with known bad length. */
> + XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen > 0);
> + XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen < MAXNAMELEN);

With gcc 4.1.2:

fs/xfs/libxfs/xfs_dir2_sf.c: In function ‘xfs_dir2_sf_verify’:
fs/xfs/libxfs/xfs_dir2_sf.c:680: warning: comparison is always true
due to limited range of data type

As sfep->namelen is __u8, and MAXNAMELEN = 256, none of the two checks
above can be true.

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

\
 
 \ /
  Last update: 2017-03-20 10:44    [W:0.022 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site