| Message ID | 20220607042444.1798015-7-tytso@mit.edu |
|---|---|
| State | Accepted |
| Headers | show |
| Series | Fix various bugs found via a fuzzing campaign | expand |
On Tue, Jun 07, 2022 at 12:24:43AM -0400, Theodore Ts'o wrote: > In the extent tree handling code in libext2fs, when we go move down > the extent tree, if a cyclic loop is detected, return an error. Looks good. Reviewed-by: Lukas Czerner <lczerner@redhat.com> > > Reported-by: Nils Bars <nils.bars@rub.de> > Reported-by: Moritz Schlögel <moritz.schloegel@rub.de> > Reported-by: Nico Schiller <nico.schiller@rub.de> > Signed-off-by: Theodore Ts'o <tytso@mit.edu> > --- > lib/ext2fs/ext2_err.et.in | 3 +++ > lib/ext2fs/extent.c | 11 +++++++++-- > 2 files changed, 12 insertions(+), 2 deletions(-) > > diff --git a/lib/ext2fs/ext2_err.et.in b/lib/ext2fs/ext2_err.et.in > index cf0e00ea..bb1dcf14 100644 > --- a/lib/ext2fs/ext2_err.et.in > +++ b/lib/ext2fs/ext2_err.et.in > @@ -551,4 +551,7 @@ ec EXT2_ET_NO_GDESC, > ec EXT2_FILSYS_CORRUPTED, > "The internal ext2_filsys data structure appears to be corrupted" > > +ec EXT2_ET_EXTENT_CYCLE, > + "Found cyclic loop in extent tree" > + > end > diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c > index 1a206a16..82e75ccd 100644 > --- a/lib/ext2fs/extent.c > +++ b/lib/ext2fs/extent.c > @@ -47,6 +47,7 @@ struct extent_path { > int visit_num; > int flags; > blk64_t end_blk; > + blk64_t blk; > void *curr; > }; > > @@ -286,6 +287,7 @@ errcode_t ext2fs_extent_open2(ext2_filsys fs, ext2_ino_t ino, > handle->path[0].end_blk = > (EXT2_I_SIZE(handle->inode) + fs->blocksize - 1) >> > EXT2_BLOCK_SIZE_BITS(fs->super); > + handle->path[0].blk = 0; > handle->path[0].visit_num = 1; > handle->level = 0; > handle->magic = EXT2_ET_MAGIC_EXTENT_HANDLE; > @@ -305,14 +307,14 @@ errout: > errcode_t ext2fs_extent_get(ext2_extent_handle_t handle, > int flags, struct ext2fs_extent *extent) > { > - struct extent_path *path, *newpath; > + struct extent_path *path, *newpath, *tp; > struct ext3_extent_header *eh; > struct ext3_extent_idx *ix = 0; > struct ext3_extent *ex; > errcode_t retval; > blk64_t blk; > blk64_t end_blk; > - int orig_op, op; > + int orig_op, op, l; > int failed_csum = 0; > > EXT2_CHECK_MAGIC(handle, EXT2_ET_MAGIC_EXTENT_HANDLE); > @@ -467,6 +469,11 @@ retry: > } > blk = ext2fs_le32_to_cpu(ix->ei_leaf) + > ((__u64) ext2fs_le16_to_cpu(ix->ei_leaf_hi) << 32); > + for (l = handle->level, tp = path; l > 0; l--, tp--) { > + if (blk == tp->blk) > + return EXT2_ET_EXTENT_CYCLE; > + } > + newpath->blk = blk; > if ((handle->fs->flags & EXT2_FLAG_IMAGE_FILE) && > (handle->fs->io != handle->fs->image_io)) > memset(newpath->buf, 0, handle->fs->blocksize); > -- > 2.31.0 >
diff --git a/lib/ext2fs/ext2_err.et.in b/lib/ext2fs/ext2_err.et.in index cf0e00ea..bb1dcf14 100644 --- a/lib/ext2fs/ext2_err.et.in +++ b/lib/ext2fs/ext2_err.et.in @@ -551,4 +551,7 @@ ec EXT2_ET_NO_GDESC, ec EXT2_FILSYS_CORRUPTED, "The internal ext2_filsys data structure appears to be corrupted" +ec EXT2_ET_EXTENT_CYCLE, + "Found cyclic loop in extent tree" + end diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c index 1a206a16..82e75ccd 100644 --- a/lib/ext2fs/extent.c +++ b/lib/ext2fs/extent.c @@ -47,6 +47,7 @@ struct extent_path { int visit_num; int flags; blk64_t end_blk; + blk64_t blk; void *curr; }; @@ -286,6 +287,7 @@ errcode_t ext2fs_extent_open2(ext2_filsys fs, ext2_ino_t ino, handle->path[0].end_blk = (EXT2_I_SIZE(handle->inode) + fs->blocksize - 1) >> EXT2_BLOCK_SIZE_BITS(fs->super); + handle->path[0].blk = 0; handle->path[0].visit_num = 1; handle->level = 0; handle->magic = EXT2_ET_MAGIC_EXTENT_HANDLE; @@ -305,14 +307,14 @@ errout: errcode_t ext2fs_extent_get(ext2_extent_handle_t handle, int flags, struct ext2fs_extent *extent) { - struct extent_path *path, *newpath; + struct extent_path *path, *newpath, *tp; struct ext3_extent_header *eh; struct ext3_extent_idx *ix = 0; struct ext3_extent *ex; errcode_t retval; blk64_t blk; blk64_t end_blk; - int orig_op, op; + int orig_op, op, l; int failed_csum = 0; EXT2_CHECK_MAGIC(handle, EXT2_ET_MAGIC_EXTENT_HANDLE); @@ -467,6 +469,11 @@ retry: } blk = ext2fs_le32_to_cpu(ix->ei_leaf) + ((__u64) ext2fs_le16_to_cpu(ix->ei_leaf_hi) << 32); + for (l = handle->level, tp = path; l > 0; l--, tp--) { + if (blk == tp->blk) + return EXT2_ET_EXTENT_CYCLE; + } + newpath->blk = blk; if ((handle->fs->flags & EXT2_FLAG_IMAGE_FILE) && (handle->fs->io != handle->fs->image_io)) memset(newpath->buf, 0, handle->fs->blocksize);
In the extent tree handling code in libext2fs, when we go move down the extent tree, if a cyclic loop is detected, return an error. Reported-by: Nils Bars <nils.bars@rub.de> Reported-by: Moritz Schlögel <moritz.schloegel@rub.de> Reported-by: Nico Schiller <nico.schiller@rub.de> Signed-off-by: Theodore Ts'o <tytso@mit.edu> --- lib/ext2fs/ext2_err.et.in | 3 +++ lib/ext2fs/extent.c | 11 +++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-)