| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 3 Nov 2020 12:35:57 -0500
From: Tong Zhang <ztong0001@...il.com>
To: David.Laight@...lab.com, Anders Larsen <al@...rsen.net>,
linux-kernel@...r.kernel.org
Cc: ztong0001@...il.com
Subject: [PATCH v4] qnx4: qnx4_block_map error handling
qnx4_block_map() may return -EIO on funny qnx4 fs image, in this case do
not interpret error as a valid block number.
Signed-off-by: Tong Zhang <ztong0001@...il.com>
---
v2: also check other callers according to Anders Larsen's<al@...rsen.net> comment
v3: change error code from EIO to ~0ull to avoid potential compiler
warning on signed/unsigned comparison
v4: revert error code back to -EIO and dedicate return value for error code. Also
print a message to let user know there is an error.
fs/qnx4/dir.c | 5 ++++-
fs/qnx4/inode.c | 14 +++++++++-----
fs/qnx4/namei.c | 6 +++++-
fs/qnx4/qnx4.h | 2 +-
4 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c
index a6ee23aadd28..49ccd7ddd83b 100644
--- a/fs/qnx4/dir.c
+++ b/fs/qnx4/dir.c
@@ -25,12 +25,15 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
unsigned long blknum;
int ix, ino;
int size;
+ int result;
QNX4DEBUG((KERN_INFO "qnx4_readdir:i_size = %ld\n", (long) inode->i_size));
QNX4DEBUG((KERN_INFO "pos = %ld\n", (long) ctx->pos));
while (ctx->pos < inode->i_size) {
- blknum = qnx4_block_map(inode, ctx->pos >> QNX4_BLOCK_SIZE_BITS);
+ result = qnx4_block_map(inode, ctx->pos >> QNX4_BLOCK_SIZE_BITS, &blknum);
+ if (result)
+ return result;
bh = sb_bread(inode->i_sb, blknum);
if (bh == NULL) {
printk(KERN_ERR "qnx4_readdir: bread failed (%ld)\n", blknum);
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index e8da1cde87b9..3333a4ef65fe 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -54,11 +54,14 @@ static int qnx4_remount(struct super_block *sb, int *flags, char *data)
static int qnx4_get_block( struct inode *inode, sector_t iblock, struct buffer_head *bh, int create )
{
+ int result;
unsigned long phys;
QNX4DEBUG((KERN_INFO "qnx4: qnx4_get_block inode=[%ld] iblock=[%ld]\n",inode->i_ino,iblock));
- phys = qnx4_block_map( inode, iblock );
+ result = qnx4_block_map(inode, iblock, &phys);
+ if (result)
+ return result;
if ( phys ) {
// logical block is before EOF
map_bh(bh, inode->i_sb, phys);
@@ -75,7 +78,7 @@ static inline u32 try_extent(qnx4_xtnt_t *extent, u32 *offset)
return 0;
}
-unsigned long qnx4_block_map( struct inode *inode, long iblock )
+int qnx4_block_map(struct inode *inode, long iblock , unsigned long *phys)
{
int ix;
long i_xblk;
@@ -97,12 +100,12 @@ unsigned long qnx4_block_map( struct inode *inode, long iblock )
// read next xtnt block.
bh = sb_bread(inode->i_sb, i_xblk - 1);
if ( !bh ) {
- QNX4DEBUG((KERN_ERR "qnx4: I/O error reading xtnt block [%ld])\n", i_xblk - 1));
+ printk(KERN_ERR "qnx4: I/O error reading xtnt block [%ld])\n", i_xblk - 1);
return -EIO;
}
xblk = (struct qnx4_xblk*)bh->b_data;
if ( memcmp( xblk->xblk_signature, "IamXblk", 7 ) ) {
- QNX4DEBUG((KERN_ERR "qnx4: block at %ld is not a valid xtnt\n", qnx4_inode->i_xblk));
+ printk(KERN_ERR "qnx4: block at %d is not a valid xtnt\n", qnx4_inode->di_xblk);
return -EIO;
}
}
@@ -123,7 +126,8 @@ unsigned long qnx4_block_map( struct inode *inode, long iblock )
}
QNX4DEBUG((KERN_INFO "qnx4: mapping block %ld of inode %ld = %ld\n",iblock,inode->i_ino,block));
- return block;
+ *phys = block;
+ return 0;
}
static int qnx4_statfs(struct dentry *dentry, struct kstatfs *buf)
diff --git a/fs/qnx4/namei.c b/fs/qnx4/namei.c
index 8d72221735d7..3d64b34dbe6e 100644
--- a/fs/qnx4/namei.c
+++ b/fs/qnx4/namei.c
@@ -59,13 +59,16 @@ static struct buffer_head *qnx4_find_entry(int len, struct inode *dir,
{
unsigned long block, offset, blkofs;
struct buffer_head *bh;
+ int result;
*res_dir = NULL;
bh = NULL;
block = offset = blkofs = 0;
while (blkofs * QNX4_BLOCK_SIZE + offset < dir->i_size) {
if (!bh) {
- block = qnx4_block_map(dir, blkofs);
+ result = qnx4_block_map(dir, blkofs, &block);
+ if (result)
+ goto out;
if (block)
bh = sb_bread(dir->i_sb, block);
if (!bh) {
@@ -88,6 +91,7 @@ static struct buffer_head *qnx4_find_entry(int len, struct inode *dir,
blkofs++;
}
brelse(bh);
+out:
*res_dir = NULL;
return NULL;
}
diff --git a/fs/qnx4/qnx4.h b/fs/qnx4/qnx4.h
index 6283705466a4..efa76aa551fc 100644
--- a/fs/qnx4/qnx4.h
+++ b/fs/qnx4/qnx4.h
@@ -24,7 +24,7 @@ struct qnx4_inode_info {
extern struct inode *qnx4_iget(struct super_block *, unsigned long);
extern struct dentry *qnx4_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags);
extern unsigned long qnx4_count_free_blocks(struct super_block *sb);
-extern unsigned long qnx4_block_map(struct inode *inode, long iblock);
+extern int qnx4_block_map(struct inode *inode, long iblock, unsigned long* phys);
extern const struct inode_operations qnx4_dir_inode_operations;
extern const struct file_operations qnx4_dir_operations;
--
2.25.1
Powered by blists - more mailing lists