Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933716AbYF3WAi (ORCPT ); Mon, 30 Jun 2008 18:00:38 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932440AbYF3WAZ (ORCPT ); Mon, 30 Jun 2008 18:00:25 -0400 Received: from kumera.dghda.com ([80.68.90.171]:3882 "EHLO kumera.dghda.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763875AbYF3WAX (ORCPT ); Mon, 30 Jun 2008 18:00:23 -0400 From: "Duane Griffin" To: linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, akpm@linux-foundation.org, sct@redhat.com, adilger@clusterfs.com, Sami Liedes , jochen.voss@googlemail.com, Jan Kara , Duane Griffin Subject: [PATCH, v5] ext3: validate directory entry data before use Date: Mon, 30 Jun 2008 23:00:18 +0100 Message-Id: <1214863218-14828-1-git-send-email-duaneg@dghda.com> X-Mailer: git-send-email 1.5.4.5 In-Reply-To: <20080630143427.GA5473@dastardly> References: <20080630143427.GA5473@dastardly> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2195 Lines: 62 ext3_dx_find_entry uses ext3_next_entry without verifying that the entry is valid. If its rec_len == 0 this causes an infinite loop. Refactor the loop to check the validity of entries before checking whether they match and moving onto the next one. There are other uses of ext3_next_entry in this file which also look problematic. They should be reviewed and fixed if/when we have a test-case that triggers them. This patch fixes the first case (image hdb.25.softlockup.gz) reported in http://bugzilla.kernel.org/show_bug.cgi?id=10882. Signed-off-by: Duane Griffin -- This is version 5. It is a safer minimal version of the patch that only fixes the original reported problem. Other potentially dangerous uses of ext3_next_entry are left untouched until/unless we get test-cases for them. --- diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c index 0b8cf80..8db2c38 100644 --- a/fs/ext3/namei.c +++ b/fs/ext3/namei.c @@ -991,19 +991,21 @@ static struct buffer_head * ext3_dx_find_entry(struct dentry *dentry, de = (struct ext3_dir_entry_2 *) bh->b_data; top = (struct ext3_dir_entry_2 *) ((char *) de + sb->s_blocksize - EXT3_DIR_REC_LEN(0)); - for (; de < top; de = ext3_next_entry(de)) - if (ext3_match (namelen, name, de)) { - if (!ext3_check_dir_entry("ext3_find_entry", - dir, de, bh, - (block<b_data))) { - brelse (bh); + for (; de < top; de = ext3_next_entry(de)) { + int off = (block << EXT3_BLOCK_SIZE_BITS(sb)) + + ((char *) de - bh->b_data); + + if (!ext3_check_dir_entry(__func__, dir, de, bh, off)) { + brelse(bh); *err = ERR_BAD_DX_DIR; goto errout; } - *res_dir = de; - dx_release (frames); - return bh; + + if (ext3_match(namelen, name, de)) { + *res_dir = de; + dx_release(frames); + return bh; + } } brelse (bh); /* Check to see if we should continue to search */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/