Received-SPF: pass (google.com: best guess record for domain of linux-ext4-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1574759039-7429-1-git-send-email-wangshilong1991@gmail.com>
 <1574759039-7429-2-git-send-email-wangshilong1991@gmail.com> <20191231005713.GA3669@mit.edu>
In-Reply-To: <20191231005713.GA3669@mit.edu>
From:   Wang Shilong <wangshilong1991@gmail.com>
Date:   Tue, 31 Dec 2019 09:41:36 +0800
Message-ID: <CAP9B-QmL_GMeOX5Tpgd80zMzx4PAWP65yxC7Kz3wXNThfmVeZA@mail.gmail.com>
Subject: Re: [PATCH 2/2] e2fsck: fix use after free in calculate_tree()
To:     "Theodore Y. Ts'o" <tytso@mit.edu>
Cc:     Ext4 Developers List <linux-ext4@vger.kernel.org>,
        Andreas Dilger <adilger@dilger.ca>, Li Xi <lixi@ddn.com>,
        Wang Shilong <wshilong@ddn.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-ext4-owner@vger.kernel.org
Precedence: bulk

Looks good to me, thanks for refresh the patch!


On Tue, Dec 31, 2019 at 8:57 AM Theodore Y. Ts'o <tytso@mit.edu> wrote:
>
> Here is the version which I plan to use in e2fsprogs's maint branch.
>
>                                  - Ted
>
> commit aacc234471a9a0ab6d8d6f610a0e4996e9bfc785
> Author: Wang Shilong <wshilong@ddn.com>
> Date:   Mon Dec 30 19:52:39 2019 -0500
>
>     e2fsck: fix use after free in calculate_tree()
>
>     The problem is alloc_blocks() will call get_next_block() which might
>     reallocate outdir->buf, and memory address could be changed after
>     this.  To fix this, pointers that point into outdir->buf, such as
>     int_limit and root need to be recaulated based on the new starting
>     address of outdir->buf.
>
>     [ Changed to correctly recalculate int_limit, and to optimize how we
>       reallocate outdir->buf.  -TYT ]
>
>     Signed-off-by: Wang Shilong <wshilong@ddn.com>
>     Signed-off-by: Theodore Ts'o <tytso@mit.edu>
>
> diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
> index 392cfe9f..54bc6803 100644
> --- a/e2fsck/rehash.c
> +++ b/e2fsck/rehash.c
> @@ -301,7 +301,11 @@ static errcode_t get_next_block(ext2_filsys fs, struct out_dir *outdir,
>         errcode_t       retval;
>
>         if (outdir->num >= outdir->max) {
> -               retval = alloc_size_dir(fs, outdir, outdir->max + 50);
> +               int increment = outdir->max / 10;
> +
> +               if (increment < 50)
> +                       increment = 50;
> +               retval = alloc_size_dir(fs, outdir, outdir->max + increment);
>                 if (retval)
>                         return retval;
>         }
> @@ -645,6 +649,9 @@ static int alloc_blocks(ext2_filsys fs,
>         if (retval)
>                 return retval;
>
> +       /* outdir->buf might be reallocated */
> +       *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
> +
>         *next_ent = set_int_node(fs, block_start);
>         *limit = (struct ext2_dx_countlimit *)(*next_ent);
>         if (next_offset)
> @@ -734,6 +741,9 @@ static errcode_t calculate_tree(ext2_filsys fs,
>                                         return retval;
>                         }
>                         if (c3 == 0) {
> +                               int delta1 = (char *)int_limit - outdir->buf;
> +                               int delta2 = (char *)root - outdir->buf;
> +
>                                 retval = alloc_blocks(fs, &limit, &int_ent,
>                                                       &dx_ent, &int_offset,
>                                                       NULL, outdir, i, &c2,
> @@ -741,6 +751,11 @@ static errcode_t calculate_tree(ext2_filsys fs,
>                                 if (retval)
>                                         return retval;
>
> +                               /* outdir->buf might be reallocated */
> +                               int_limit = (struct ext2_dx_countlimit *)
> +                                       (outdir->buf + delta1);
> +                               root = (struct ext2_dx_entry *)
> +                                       (outdir->buf + delta2);
>                         }
>                         dx_ent->block = ext2fs_cpu_to_le32(i);
>                         if (c3 != limit->limit)
>