| Message ID | 1448571594-32225-1-git-send-email-artemiyv@acm.org |
|---|---|
| State | Accepted, archived |
| Headers | show |
On Thu, Nov 26, 2015 at 08:59:54PM +0000, Artemiy Volkov wrote: > In check_inode_extra_space(), if we attempt to read an EA header at > the end of the extra space, in a corrupted filesystem it may result in > a read beyond the bounds of the inode. Add a check to prevent this. > > Reproduced by running ./test_one --valgrind f_write_ea_toobig_extra_isize. > > Signed-off-by: Artemiy Volkov <artemiyv@acm.org> > --- > > A quick fix to v1 which wrongly uses spaces instead of tabs. > Correct a nonexistent struct ext2_inode_large field name used in v2. > > e2fsck/pass1.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c > index 0a8e23e..71ea943 100644 > --- a/e2fsck/pass1.c > +++ b/e2fsck/pass1.c > @@ -482,6 +482,10 @@ static void check_inode_extra_space(e2fsck_t ctx, struct problem_context *pctx) > return; > } > > + /* check if there is no place for an EA header */ > + if (inode->i_extra_isize >= max - sizeof(__u32)) > + return; > + Looks reasonable enough. Acked-by: Darrick J. Wong <darrick.wong@oracle.com> --D > eamagic = (__u32 *) (((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE + > inode->i_extra_isize); > if (*eamagic == EXT2_EXT_ATTR_MAGIC) { > -- > 1.7.10.4 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Nov 26, 2015 at 08:59:54PM +0000, Artemiy Volkov wrote: > In check_inode_extra_space(), if we attempt to read an EA header at > the end of the extra space, in a corrupted filesystem it may result in > a read beyond the bounds of the inode. Add a check to prevent this. > > Reproduced by running ./test_one --valgrind f_write_ea_toobig_extra_isize. > > Signed-off-by: Artemiy Volkov <artemiyv@acm.org> Applied, thanks. - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c index 0a8e23e..71ea943 100644 --- a/e2fsck/pass1.c +++ b/e2fsck/pass1.c @@ -482,6 +482,10 @@ static void check_inode_extra_space(e2fsck_t ctx, struct problem_context *pctx) return; } + /* check if there is no place for an EA header */ + if (inode->i_extra_isize >= max - sizeof(__u32)) + return; + eamagic = (__u32 *) (((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE + inode->i_extra_isize); if (*eamagic == EXT2_EXT_ATTR_MAGIC) {
In check_inode_extra_space(), if we attempt to read an EA header at the end of the extra space, in a corrupted filesystem it may result in a read beyond the bounds of the inode. Add a check to prevent this. Reproduced by running ./test_one --valgrind f_write_ea_toobig_extra_isize. Signed-off-by: Artemiy Volkov <artemiyv@acm.org> --- A quick fix to v1 which wrongly uses spaces instead of tabs. Correct a nonexistent struct ext2_inode_large field name used in v2. e2fsck/pass1.c | 4 ++++ 1 file changed, 4 insertions(+)