diff mbox

[16/24] e2fsck: don't crash during rehash

Message ID 20140718225415.31374.89196.stgit@birch.djwong.org
State Accepted, archived
Headers show

Commit Message

Darrick Wong July 18, 2014, 10:54 p.m. UTC 
If a user crafts a carefully constructed filesystem containing a
single directory entry block with an invalid checksum and fewer than
two entries, and then runs e2fsck to fix the filesystem, fsck will
crash when it tries to "compress" the short dir and passes a negative
dirent array length to qsort.  Therefore, don't allow directory
"compression" in this situation.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 e2fsck/rehash.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)



--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Theodore Ts'o July 25, 2014, 11:22 a.m. UTC | #1 
On Fri, Jul 18, 2014 at 03:54:15PM -0700, Darrick J. Wong wrote:
> If a user crafts a carefully constructed filesystem containing a
> single directory entry block with an invalid checksum and fewer than
> two entries, and then runs e2fsck to fix the filesystem, fsck will
> crash when it tries to "compress" the short dir and passes a negative
> dirent array length to qsort.  Therefore, don't allow directory
> "compression" in this situation.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Thanks, applied.

				- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
index f75479a..5913ae7 100644
--- a/e2fsck/rehash.c
+++ b/e2fsck/rehash.c
@@ -848,7 +848,7 @@  retry_nohash:
 
 	/* Sort the list */
 resort:
-	if (fd.compress)
+	if (fd.compress && fd.num_array > 1)
 		qsort(fd.harray+2, fd.num_array-2, sizeof(struct hash_entry),
 		      hash_cmp);
 	else
@@ -867,7 +867,7 @@  resort:
 	}
 
 	/* Sort non-hashed directories by inode number */
-	if (fd.compress)
+	if (fd.compress && fd.num_array > 1)
 		qsort(fd.harray+2, fd.num_array-2,
 		      sizeof(struct hash_entry), ino_cmp);