Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 80eb68d23897126e7f25e2b3689bc27fb8cdde17

Authored by Lepton Wu
Committed by Linus Torvalds
1 parent a6cd6bf9f8
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

reiserfs: fix kernel panic on corrupted directory 

When reading corrupted reiserfs directory data, d_reclen could be a
negative number or a big positive number, this can lead to kernel panic or
oop.  The following patch adds a sanity check.

Signed-off-by: Lepton Wu <ytht.net@gmail.com>
Cc: Chris Mason <chris.mason@oracle.com>
Cc: Jeff Mahoney <jeffm@suse.com>
Cc: "Vladimir V. Saveliev" <vs@namesys.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 10 additions and 0 deletions Side-by-side Diff

... ... @@ -121,6 +121,16 @@
121 121 continue;
122 122 d_reclen = entry_length(bh, ih, entry_num);
123 123 d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh);
  124 +
  125 + if (d_reclen <= 0 ||
  126 + d_name + d_reclen > bh->b_data + bh->b_size) {
  127 + /* There is corrupted data in entry,
  128 + * We'd better stop here */
  129 + pathrelse(&path_to_entry);
  130 + ret = -EIO;
  131 + goto out;
  132 + }
  133 +
124 134 if (!d_name[d_reclen - 1])
125 135 d_reclen = strlen(d_name);
126 136