linux-ext4 - [PATCH] ext4: Check extent overflow with the right range.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1318841128-4540-1-git-send-email-tm@tao.ma>
Date:	Mon, 17 Oct 2011 16:45:28 +0800
From:	Tao Ma <tm@....ma>
To:	linux-ext4@...r.kernel.org
Cc:	dan.carpenter@...cle.com, "Theodore Ts'o" <tytso@....edu>
Subject: [PATCH] ext4: Check extent overflow with the right range.

From: Tao Ma <boyu.mt@...bao.com>

In 4fd30c033, we move the range check before we change ix to avoid the memory stamp.
But actually we should check against the EXT_MAX_INDEX, not EXT_LAST_INDEX.

So this patch revert the old patch and adds a new check before we setting ix.

Cc: "Theodore Ts'o" <tytso@....edu>
Signed-off-by: Tao Ma <boyu.mt@...bao.com>
---
Ted, since 4fd30c033 is in your dev branch, I am fine to integrate these 2 patches to one.

 fs/ext4/extents.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2dff31e..5c48612 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -779,8 +779,8 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
 		ix = curp->p_idx;
 	}
 
-	if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
-		EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
+	if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
+		EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
 		return -EIO;
 	}
 
@@ -788,6 +788,11 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
 	ext4_idx_store_pblock(ix, ptr);
 	le16_add_cpu(&curp->p_hdr->eh_entries, 1);
 
+	if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
+		EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
+		return -EIO;
+	}
+
 	err = ext4_ext_dirty(handle, inode, curp);
 	ext4_std_error(inode->i_sb, err);
 
-- 
1.6.3.3.334.g916e1.dirty

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html