linux-ext4 - [PATCH 05/27] e2fsck: on BE, re-swap everything after a damaged dirent so salvage works correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 16 Aug 2014 16:46:23 -0700
From:	"Darrick J. Wong" <darrick.wong@...cle.com>
To:	tytso@....edu, darrick.wong@...cle.com
Cc:	linux-ext4@...r.kernel.org
Subject: [PATCH 05/27] e2fsck: on BE,
 re-swap everything after a damaged dirent so salvage works correctly

On big-endian systems, if the dirent swap routine finds a rec_len that
it doesn't like, it continues processing the block as if rec_len == 8.
This means that the name field gets byte swapped, which means that
salvage will not detect the correct name length (unless the name has a
length that's an exact multiple of four bytes), and it'll discard the
entry (unnecessarily) and the rest of the dirent block.  Therefore,
swap the rest of the block back to disk order, run salvage, and
re-swap anything after the salvaged dirent.

The test case for this is f_inlinedata_repair if you run it on a BE
system.

Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com>
---
 e2fsck/pass2.c |   38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/e2fsck/pass2.c b/e2fsck/pass2.c
index 23310f1..0b9c5c5 100644
--- a/e2fsck/pass2.c
+++ b/e2fsck/pass2.c
@@ -1058,9 +1058,47 @@ skip_checksum:
 			    ((ext2fs_dirent_name_len(dirent) + 8) > rec_len)) {
 				if (fix_problem(ctx, PR_2_DIR_CORRUPTED,
 						&cd->pctx)) {
+#ifdef WORDS_BIGENDIAN
+					/*
+					 * On big-endian systems, if the dirent
+					 * swap routine finds a rec_len that it
+					 * doesn't like, it continues
+					 * processing the block as if rec_len
+					 * == 8.  This means that the name
+					 * field gets byte swapped, which means
+					 * that salvage will not detect the
+					 * correct name length (unless the name
+					 * has a length that's an exact
+					 * multiple of four bytes), and it'll
+					 * discard the entry (unnecessarily)
+					 * and the rest of the dirent block.
+					 * Therefore, swap the rest of the
+					 * block back to disk order, run
+					 * salvage, and re-swap anything after
+					 * the salvaged dirent.
+					 */
+					int need_reswab = 0;
+					if (rec_len < 8 || rec_len % 4) {
+						need_reswab = 1;
+						ext2fs_dirent_swab_in2(fs,
+							((char *)dirent) + 8,
+							max_block_size - offset - 8,
+							0);
+					}
+#endif
 					salvage_directory(fs, dirent, prev,
 							  &offset,
 							  max_block_size);
+#ifdef WORDS_BIGENDIAN
+					if (need_reswab) {
+						(void) ext2fs_get_rec_len(fs,
+							dirent, &rec_len);
+						ext2fs_dirent_swab_in2(fs,
+							((char *)dirent) + offset + rec_len,
+							max_block_size - offset - rec_len,
+							0);
+					}
+#endif
 					dir_modified++;
 					continue;
 				} else

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html