Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4a13f58 authored by Chao Yu's avatar Chao Yu Committed by Jaegeuk Kim
Browse files

f2fs: be aware of invalid filename length 



The filename length in dirent of may become zero-sized after random junk
data injection, once encounter such dirent, find_target_dentry or
f2fs_add_inline_entries will run into an infinite loop. So let f2fs being
aware of that to avoid deadloop.

Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent ae9b9a9d

fs/f2fs/dir.c

+5 −9
Original line number Diff line number Diff line
@@ -101,11 +101,6 @@ static struct f2fs_dir_entry *find_in_block(struct page *dentry_page, 
	else

		kunmap(dentry_page);



	/*

	 * For the most part, it should be a bug when name_len is zero.

	 * We stop here for figuring out where the bugs has occurred.

	 */

	f2fs_bug_on(F2FS_P_SB(dentry_page), d.max < 0);

	return de;

}
@@ -130,6 +125,11 @@ struct f2fs_dir_entry *find_target_dentry(struct fscrypt_name *fname, 


		de = &d->dentry[bit_pos];



		if (unlikely(!de->name_len)) {

			bit_pos++;

			continue;

		}



		/* encrypted case */

		de_name.name = d->filename[bit_pos];

		de_name.len = le16_to_cpu(de->name_len);
@@ -147,10 +147,6 @@ struct f2fs_dir_entry *find_target_dentry(struct fscrypt_name *fname, 
			*max_slots = max_len;

		max_len = 0;



		/* remain bug on condition */

		if (unlikely(!de->name_len))

			d->max = -1;



		bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));

	}

fs/f2fs/inline.c

+6 −8
Original line number Diff line number Diff line
@@ -303,11 +303,6 @@ struct f2fs_dir_entry *find_in_inline_dir(struct inode *dir, 
	else

		f2fs_put_page(ipage, 0);



	/*

	 * For the most part, it should be a bug when name_len is zero.

	 * We stop here for figuring out where the bugs has occurred.

	 */

	f2fs_bug_on(sbi, d.max < 0);

	return de;

}
@@ -437,6 +432,12 @@ static int f2fs_add_inline_entries(struct inode *dir, 
		}



		de = &d.dentry[bit_pos];



		if (unlikely(!de->name_len)) {

			bit_pos++;

			continue;

		}



		new_name.name = d.filename[bit_pos];

		new_name.len = de->name_len;
@@ -448,9 +449,6 @@ static int f2fs_add_inline_entries(struct inode *dir, 
		if (err)

			goto punch_dentry_pages;



		if (unlikely(!de->name_len))

			d.max = -1;



		bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));

	}

	return 0;