lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 646/772] ext4: avoid cycles in directory h-tree
    Date
    From: Jan Kara <jack@suse.cz>

    commit 3ba733f879c2a88910744647e41edeefbc0d92b2 upstream.

    A maliciously corrupted filesystem can contain cycles in the h-tree
    stored inside a directory. That can easily lead to the kernel corrupting
    tree nodes that were already verified under its hands while doing a node
    split and consequently accessing unallocated memory. Fix the problem by
    verifying traversed block numbers are unique.

    Cc: stable@vger.kernel.org
    Signed-off-by: Jan Kara <jack@suse.cz>
    Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ext4/namei.c | 22 +++++++++++++++++++---
    1 file changed, 19 insertions(+), 3 deletions(-)

    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -777,12 +777,14 @@ static struct dx_frame *
    dx_probe(struct ext4_filename *fname, struct inode *dir,
    struct dx_hash_info *hinfo, struct dx_frame *frame_in)
    {
    - unsigned count, indirect;
    + unsigned count, indirect, level, i;
    struct dx_entry *at, *entries, *p, *q, *m;
    struct dx_root *root;
    struct dx_frame *frame = frame_in;
    struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR);
    u32 hash;
    + ext4_lblk_t block;
    + ext4_lblk_t blocks[EXT4_HTREE_LEVEL];

    memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0]));
    frame->bh = ext4_read_dirblock(dir, 0, INDEX);
    @@ -854,6 +856,8 @@ dx_probe(struct ext4_filename *fname, st
    }

    dxtrace(printk("Look up %x", hash));
    + level = 0;
    + blocks[0] = 0;
    while (1) {
    count = dx_get_count(entries);
    if (!count || count > dx_get_limit(entries)) {
    @@ -882,15 +886,27 @@ dx_probe(struct ext4_filename *fname, st
    dx_get_block(at)));
    frame->entries = entries;
    frame->at = at;
    - if (!indirect--)
    +
    + block = dx_get_block(at);
    + for (i = 0; i <= level; i++) {
    + if (blocks[i] == block) {
    + ext4_warning_inode(dir,
    + "dx entry: tree cycle block %u points back to block %u",
    + blocks[level], block);
    + goto fail;
    + }
    + }
    + if (++level > indirect)
    return frame;
    + blocks[level] = block;
    frame++;
    - frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX);
    + frame->bh = ext4_read_dirblock(dir, block, INDEX);
    if (IS_ERR(frame->bh)) {
    ret_err = (struct dx_frame *) frame->bh;
    frame->bh = NULL;
    goto fail;
    }
    +
    entries = ((struct dx_node *) frame->bh->b_data)->entries;

    if (dx_get_limit(entries) != dx_node_limit(dir)) {

    \
     
     \ /
      Last update: 2022-09-17 16:24    [W:2.412 / U:0.356 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site