linux-ext4 - Re: [PATCH] ext4: Check extent overflow with the right range.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGBYx2bTHT9BNYK6=tGzJd3neXR6WAOjvWLSzv5XpTYcTUeCnA@mail.gmail.com>
Date:	Mon, 17 Oct 2011 17:10:14 +0800
From:	Yongqiang Yang <xiaoqiangnk@...il.com>
To:	Tao Ma <tm@....ma>
Cc:	linux-ext4@...r.kernel.org, dan.carpenter@...cle.com,
	"Theodore Ts'o" <tytso@....edu>
Subject: Re: [PATCH] ext4: Check extent overflow with the right range.

On Mon, Oct 17, 2011 at 4:45 PM, Tao Ma <tm@....ma> wrote:
> From: Tao Ma <boyu.mt@...bao.com>
>
> In 4fd30c033, we move the range check before we change ix to avoid the memory stamp.
> But actually we should check against the EXT_MAX_INDEX, not EXT_LAST_INDEX.
>
> So this patch revert the old patch and adds a new check before we setting ix.
>
> Cc: "Theodore Ts'o" <tytso@....edu>
> Signed-off-by: Tao Ma <boyu.mt@...bao.com>
> ---
> Ted, since 4fd30c033 is in your dev branch, I am fine to integrate these 2 patches to one.
>
>  fs/ext4/extents.c |    9 +++++++--
>  1 files changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
> index 2dff31e..5c48612 100644
> --- a/fs/ext4/extents.c
> +++ b/fs/ext4/extents.c
> @@ -779,8 +779,8 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
>                ix = curp->p_idx;
>        }
>
> -       if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
> -               EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
> +       if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
> +               EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
>                return -EIO;
>        }
Hi Tao,

I think original LAST_INDEX check aims to verify all index entries are
contiguous, because max entries bas been checked by eh_entries >=
ex_max in previous code.
>
> @@ -788,6 +788,11 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
>        ext4_idx_store_pblock(ix, ptr);
>        le16_add_cpu(&curp->p_hdr->eh_entries, 1);
>
> +       if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
> +               EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
> +               return -EIO;
> +       }
> +
Actually I do not think we need a verification here.  The code is
short and we know that index entries are contiguous.


Yongqiang.
>        err = ext4_ext_dirty(handle, inode, curp);
>        ext4_std_error(inode->i_sb, err);
>
> --
> 1.6.3.3.334.g916e1.dirty
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>



-- 
Best Wishes
Yongqiang Yang
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html