diff options
| author | dann frazier <dannf@debian.org> | 2008-01-21 17:16:51 -0700 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2008-07-20 18:25:37 +0200 |
| commit | 07621be8aaf9d7fedc67861ce78075662cf27e3a (patch) | |
| tree | 3e720c4a3c1c5896bdd5eda70a918ccf92dc5626 /fs | |
| parent | e942af21b7fda832e02e10941b5696b7b3075025 (diff) | |
| download | linux-2.4-07621be8aaf9d7fedc67861ce78075662cf27e3a.tar.gz | |
ext2: skip pages past number of blocks in ext2_find_entry
This is a 2.4 backport of a linux-2.6 change by Eric Sandeen
(commit d8adb9cef7e406a9a82881695097c702bc98422f)
CVE-2006-6054 was assigned for this issue, which is easily reproducible in 2.4.
However, this changeset alone does not resolve the issue for 2.4 - two earlier
backports for ext2_readdir() are required.
Commit log from 2.6 follows.
[PATCH] ext2: skip pages past number of blocks in ext2_find_entry
This one was pointed out on the MOKB site:
http://kernelfun.blogspot.com/2006/11/mokb-09-11-2006-linux-26x-ext2checkpage.html
If a directory's i_size is corrupted, ext2_find_entry() will keep
processing pages until the i_size is reached, even if there are no more
blocks associated with the directory inode. This patch puts in some
minimal sanity-checking so that we don't keep checking pages (and issuing
errors) if we know there can be no more data to read, based on the block
count of the directory inode.
This is somewhat similar in approach to the ext3 patch I sent earlier this
year.
Signed-off-by: dann frazier <dannf@hp.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext2/dir.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c index 71338c66a6427f..9aa3d1b0152860 100644 --- a/fs/ext2/dir.c +++ b/fs/ext2/dir.c @@ -339,7 +339,16 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode * dir, } if (++n >= npages) n = 0; + /* next page is past the blocks we've got */ + if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) { + ext2_error(dir->i_sb, __FUNCTION__, + "dir %lu size %lld exceeds block count %llu", + dir->i_ino, dir->i_size, + (unsigned long long)dir->i_blocks); + goto out; + } } while (n != start); +out: return NULL; found: |