mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-31 16:38:12 +00:00
ext4: verify dir block before splitting it
Before splitting a directory block verify its directory entries are sane so that the splitting code does not access memory it should not. Cc: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20220518093332.13986-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
parent
c878bea3c9
commit
46c116b920
1 changed files with 21 additions and 11 deletions
|
@ -277,9 +277,9 @@ static struct dx_frame *dx_probe(struct ext4_filename *fname,
|
|||
struct dx_hash_info *hinfo,
|
||||
struct dx_frame *frame);
|
||||
static void dx_release(struct dx_frame *frames);
|
||||
static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
|
||||
unsigned blocksize, struct dx_hash_info *hinfo,
|
||||
struct dx_map_entry map[]);
|
||||
static int dx_make_map(struct inode *dir, struct buffer_head *bh,
|
||||
struct dx_hash_info *hinfo,
|
||||
struct dx_map_entry *map_tail);
|
||||
static void dx_sort_map(struct dx_map_entry *map, unsigned count);
|
||||
static struct ext4_dir_entry_2 *dx_move_dirents(struct inode *dir, char *from,
|
||||
char *to, struct dx_map_entry *offsets,
|
||||
|
@ -1249,15 +1249,23 @@ static inline int search_dirblock(struct buffer_head *bh,
|
|||
* Create map of hash values, offsets, and sizes, stored at end of block.
|
||||
* Returns number of entries mapped.
|
||||
*/
|
||||
static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
|
||||
unsigned blocksize, struct dx_hash_info *hinfo,
|
||||
static int dx_make_map(struct inode *dir, struct buffer_head *bh,
|
||||
struct dx_hash_info *hinfo,
|
||||
struct dx_map_entry *map_tail)
|
||||
{
|
||||
int count = 0;
|
||||
char *base = (char *) de;
|
||||
struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)bh->b_data;
|
||||
unsigned int buflen = bh->b_size;
|
||||
char *base = bh->b_data;
|
||||
struct dx_hash_info h = *hinfo;
|
||||
|
||||
while ((char *) de < base + blocksize) {
|
||||
if (ext4_has_metadata_csum(dir->i_sb))
|
||||
buflen -= sizeof(struct ext4_dir_entry_tail);
|
||||
|
||||
while ((char *) de < base + buflen) {
|
||||
if (ext4_check_dir_entry(dir, NULL, de, bh, base, buflen,
|
||||
((char *)de) - base))
|
||||
return -EFSCORRUPTED;
|
||||
if (de->name_len && de->inode) {
|
||||
if (ext4_hash_in_dirent(dir))
|
||||
h.hash = EXT4_DIRENT_HASH(de);
|
||||
|
@ -1270,8 +1278,7 @@ static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
|
|||
count++;
|
||||
cond_resched();
|
||||
}
|
||||
/* XXX: do we need to check rec_len == 0 case? -Chris */
|
||||
de = ext4_next_entry(de, blocksize);
|
||||
de = ext4_next_entry(de, dir->i_sb->s_blocksize);
|
||||
}
|
||||
return count;
|
||||
}
|
||||
|
@ -1943,8 +1950,11 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
|
|||
|
||||
/* create map in the end of data2 block */
|
||||
map = (struct dx_map_entry *) (data2 + blocksize);
|
||||
count = dx_make_map(dir, (struct ext4_dir_entry_2 *) data1,
|
||||
blocksize, hinfo, map);
|
||||
count = dx_make_map(dir, *bh, hinfo, map);
|
||||
if (count < 0) {
|
||||
err = count;
|
||||
goto journal_error;
|
||||
}
|
||||
map -= count;
|
||||
dx_sort_map(map, count);
|
||||
/* Ensure that neither split block is over half full */
|
||||
|
|
Loading…
Reference in a new issue