diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2022-06-06 22:49:47 -0400 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2022-06-07 00:01:33 -0400 |
| commit | 2d30ab20ae4eda6660ead5c79367e91e85322233 (patch) | |
| tree | b5c16dbba6cc6b66b70be3591be13932b6833384 | |
| parent | 8d66e7e9316002ca9f9d558069bd56ccba9cece8 (diff) | |
| download | e2fsprogs-2d30ab20ae4eda6660ead5c79367e91e85322233.tar.gz | |
libext2fs: check for cyclic loops in the extent tree
In the extent tree handling code in libext2fs, when we go move down
the extent tree, if a cyclic loop is detected, return an error.
Reported-by: Nils Bars <nils.bars@rub.de>
Reported-by: Moritz Schlögel <moritz.schloegel@rub.de>
Reported-by: Nico Schiller <nico.schiller@rub.de>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
| -rw-r--r-- | lib/ext2fs/ext2_err.et.in | 3 | ||||
| -rw-r--r-- | lib/ext2fs/extent.c | 11 |
2 files changed, 12 insertions, 2 deletions
diff --git a/lib/ext2fs/ext2_err.et.in b/lib/ext2fs/ext2_err.et.in index cf0e00ea3..bb1dcf149 100644 --- a/lib/ext2fs/ext2_err.et.in +++ b/lib/ext2fs/ext2_err.et.in @@ -551,4 +551,7 @@ ec EXT2_ET_NO_GDESC, ec EXT2_FILSYS_CORRUPTED, "The internal ext2_filsys data structure appears to be corrupted" +ec EXT2_ET_EXTENT_CYCLE, + "Found cyclic loop in extent tree" + end diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c index 1a206a16c..82e75ccd7 100644 --- a/lib/ext2fs/extent.c +++ b/lib/ext2fs/extent.c @@ -47,6 +47,7 @@ struct extent_path { int visit_num; int flags; blk64_t end_blk; + blk64_t blk; void *curr; }; @@ -286,6 +287,7 @@ errcode_t ext2fs_extent_open2(ext2_filsys fs, ext2_ino_t ino, handle->path[0].end_blk = (EXT2_I_SIZE(handle->inode) + fs->blocksize - 1) >> EXT2_BLOCK_SIZE_BITS(fs->super); + handle->path[0].blk = 0; handle->path[0].visit_num = 1; handle->level = 0; handle->magic = EXT2_ET_MAGIC_EXTENT_HANDLE; @@ -305,14 +307,14 @@ errout: errcode_t ext2fs_extent_get(ext2_extent_handle_t handle, int flags, struct ext2fs_extent *extent) { - struct extent_path *path, *newpath; + struct extent_path *path, *newpath, *tp; struct ext3_extent_header *eh; struct ext3_extent_idx *ix = 0; struct ext3_extent *ex; errcode_t retval; blk64_t blk; blk64_t end_blk; - int orig_op, op; + int orig_op, op, l; int failed_csum = 0; EXT2_CHECK_MAGIC(handle, EXT2_ET_MAGIC_EXTENT_HANDLE); @@ -467,6 +469,11 @@ retry: } blk = ext2fs_le32_to_cpu(ix->ei_leaf) + ((__u64) ext2fs_le16_to_cpu(ix->ei_leaf_hi) << 32); + for (l = handle->level, tp = path; l > 0; l--, tp--) { + if (blk == tp->blk) + return EXT2_ET_EXTENT_CYCLE; + } + newpath->blk = blk; if ((handle->fs->flags & EXT2_FLAG_IMAGE_FILE) && (handle->fs->io != handle->fs->image_io)) memset(newpath->buf, 0, handle->fs->blocksize); |