lkml.org 
[lkml]   [2018]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 042/140] ext4: fix crash when a directory's i_size is too small
    3.2.100-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chandan Rajendra <chandan@linux.vnet.ibm.com>

    commit 9d5afec6b8bd46d6ed821aa1579634437f58ef1f upstream.

    On a ppc64 machine, when mounting a fuzzed ext2 image (generated by
    fsfuzzer) the following call trace is seen,

    VFS: brelse: Trying to free free buffer
    WARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40
    .__brelse.part.6+0x20/0x40 (unreliable)
    .ext4_find_entry+0x384/0x4f0
    .ext4_lookup+0x84/0x250
    .lookup_slow+0xdc/0x230
    .walk_component+0x268/0x400
    .path_lookupat+0xec/0x2d0
    .filename_lookup+0x9c/0x1d0
    .vfs_statx+0x98/0x140
    .SyS_newfstatat+0x48/0x80
    system_call+0x58/0x6c

    This happens because the directory that ext4_find_entry() looks up has
    inode->i_size that is less than the block size of the filesystem. This
    causes 'nblocks' to have a value of zero. ext4_bread_batch() ends up not
    reading any of the directory file's blocks. This renders the entries in
    bh_use[] array to continue to have garbage data. buffer_uptodate() on
    bh_use[0] can then return a zero value upon which brelse() function is
    invoked.

    This commit fixes the bug by returning -ENOENT when the directory file
    has no associated blocks.

    Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
    Signed-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/ext4/namei.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -892,6 +892,10 @@ static struct buffer_head * ext4_find_en
    "falling back\n"));
    }
    nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
    + if (!nblocks) {
    + ret = NULL;
    + goto cleanup_and_exit;
    + }
    start = EXT4_I(dir)->i_dir_start_lookup;
    if (start >= nblocks)
    start = 0;
    \
     
     \ /
      Last update: 2018-02-28 17:43    [W:4.090 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site