Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e157c8f8 authored by Jan Kara's avatar Jan Kara Committed by Greg Kroah-Hartman
Browse files

ext4: avoid cycles in directory h-tree 



commit 3ba733f879c2a88910744647e41edeefbc0d92b2 upstream.

A maliciously corrupted filesystem can contain cycles in the h-tree
stored inside a directory. That can easily lead to the kernel corrupting
tree nodes that were already verified under its hands while doing a node
split and consequently accessing unallocated memory. Fix the problem by
verifying traversed block numbers are unique.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220518093332.13986-2-jack@suse.cz


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 17034d45

fs/ext4/namei.c

+19 −3
Original line number Diff line number Diff line
@@ -750,12 +750,14 @@ static struct dx_frame * 
dx_probe(struct ext4_filename *fname, struct inode *dir,

	 struct dx_hash_info *hinfo, struct dx_frame *frame_in)

{

	unsigned count, indirect;

	unsigned count, indirect, level, i;

	struct dx_entry *at, *entries, *p, *q, *m;

	struct dx_root *root;

	struct dx_frame *frame = frame_in;

	struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR);

	u32 hash;

	ext4_lblk_t block;

	ext4_lblk_t blocks[EXT4_HTREE_LEVEL];



	memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0]));

	frame->bh = ext4_read_dirblock(dir, 0, INDEX);
@@ -811,6 +813,8 @@ dx_probe(struct ext4_filename *fname, struct inode *dir, 
	}



	dxtrace(printk("Look up %x", hash));

	level = 0;

	blocks[0] = 0;

	while (1) {

		count = dx_get_count(entries);

		if (!count || count > dx_get_limit(entries)) {
@@ -852,15 +856,27 @@ dx_probe(struct ext4_filename *fname, struct inode *dir, 
			       dx_get_block(at)));

		frame->entries = entries;

		frame->at = at;

		if (!indirect--)



		block = dx_get_block(at);

		for (i = 0; i <= level; i++) {

			if (blocks[i] == block) {

				ext4_warning_inode(dir,

					"dx entry: tree cycle block %u points back to block %u",

					blocks[level], block);

				goto fail;

			}

		}

		if (++level > indirect)

			return frame;

		blocks[level] = block;

		frame++;

		frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX);

		frame->bh = ext4_read_dirblock(dir, block, INDEX);

		if (IS_ERR(frame->bh)) {

			ret_err = (struct dx_frame *) frame->bh;

			frame->bh = NULL;

			goto fail;

		}



		entries = ((struct dx_node *) frame->bh->b_data)->entries;



		if (dx_get_limit(entries) != dx_node_limit(dir)) {