Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs fixes from Gao Xiang:
- Fix dirent nameoff handling to avoid out-of-bound reads
out of crafted images
- Fix two type truncation issues on 32-bit platforms
* tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: unify lcn as u64 for 32-bit platforms
erofs: fix offset truncation when shifting pgoff on 32-bit platforms
erofs: fix the out-of-bounds nameoff handling for trailing dirents
+26
-25
+1
-1
fs/erofs/data.c
+1
-1
fs/erofs/data.c
+15
-13
fs/erofs/dir.c
+15
-13
fs/erofs/dir.c
···
19
19
const char *de_name = (char *)dentry_blk + nameoff;
20
20
unsigned int de_namelen;
21
21
22
-
/* the last dirent in the block? */
23
-
if (de + 1 >= end)
24
-
de_namelen = strnlen(de_name, maxsize - nameoff);
25
-
else
22
+
/* non-trailing dirent in the directory block? */
23
+
if (de + 1 < end)
26
24
de_namelen = le16_to_cpu(de[1].nameoff) - nameoff;
25
+
else if (maxsize <= nameoff)
26
+
goto err_bogus;
27
+
else
28
+
de_namelen = strnlen(de_name, maxsize - nameoff);
27
29
28
-
/* a corrupted entry is found */
29
-
if (nameoff + de_namelen > maxsize ||
30
-
de_namelen > EROFS_NAME_LEN) {
31
-
erofs_err(dir->i_sb, "bogus dirent @ nid %llu",
32
-
EROFS_I(dir)->nid);
33
-
DBG_BUGON(1);
34
-
return -EFSCORRUPTED;
35
-
}
30
+
/* a corrupted entry is found (including negative namelen) */
31
+
if (!in_range32(de_namelen, 1, EROFS_NAME_LEN) ||
32
+
nameoff + de_namelen > maxsize)
33
+
goto err_bogus;
36
34
37
35
if (!dir_emit(ctx, de_name, de_namelen,
38
36
erofs_nid_to_ino64(EROFS_SB(dir->i_sb),
···
40
42
ctx->pos += sizeof(struct erofs_dirent);
41
43
}
42
44
return 0;
45
+
err_bogus:
46
+
erofs_err(dir->i_sb, "bogus dirent @ nid %llu", EROFS_I(dir)->nid);
47
+
DBG_BUGON(1);
48
+
return -EFSCORRUPTED;
43
49
}
44
50
45
51
static int erofs_readdir(struct file *f, struct dir_context *ctx)
···
90
88
}
91
89
92
90
nameoff = le16_to_cpu(de->nameoff);
93
-
if (nameoff < sizeof(struct erofs_dirent) || nameoff >= bsz) {
91
+
if (!nameoff || nameoff >= bsz || (nameoff % sizeof(*de))) {
94
92
erofs_err(sb, "invalid de[0].nameoff %u @ nid %llu",
95
93
nameoff, EROFS_I(dir)->nid);
96
94
err = -EFSCORRUPTED;
+1
-1
fs/erofs/zdata.c
+1
-1
fs/erofs/zdata.c
+9
-10
fs/erofs/zmap.c
+9
-10
fs/erofs/zmap.c
···
10
10
struct z_erofs_maprecorder {
11
11
struct inode *inode;
12
12
struct erofs_map_blocks *map;
13
-
unsigned long lcn;
13
+
u64 lcn;
14
14
/* compression extent information gathered */
15
15
u8 type, headtype;
16
16
u16 clusterofs;
···
20
20
bool partialref, in_mbox;
21
21
};
22
22
23
-
static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m,
24
-
unsigned long lcn)
23
+
static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, u64 lcn)
25
24
{
26
25
struct inode *const inode = m->inode;
27
26
struct erofs_inode *const vi = EROFS_I(inode);
···
93
94
}
94
95
95
96
static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,
96
-
unsigned long lcn, bool lookahead)
97
+
u64 lcn, bool lookahead)
97
98
{
98
99
struct inode *const inode = m->inode;
99
100
struct erofs_inode *const vi = EROFS_I(inode);
···
233
234
}
234
235
235
236
static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m,
236
-
unsigned int lcn, bool lookahead)
237
+
u64 lcn, bool lookahead)
237
238
{
238
239
struct erofs_inode *vi = EROFS_I(m->inode);
239
240
int err;
···
248
249
return err;
249
250
250
251
if (m->type >= Z_EROFS_LCLUSTER_TYPE_MAX) {
251
-
erofs_err(m->inode->i_sb, "unknown type %u @ lcn %u of nid %llu",
252
+
erofs_err(m->inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
252
253
m->type, lcn, EROFS_I(m->inode)->nid);
253
254
DBG_BUGON(1);
254
255
return -EOPNOTSUPP;
···
268
269
const unsigned int lclusterbits = vi->z_lclusterbits;
269
270
270
271
while (m->lcn >= lookback_distance) {
271
-
unsigned long lcn = m->lcn - lookback_distance;
272
+
u64 lcn = m->lcn - lookback_distance;
272
273
int err;
273
274
274
275
if (!lookback_distance)
···
285
286
m->map->m_la = (lcn << lclusterbits) | m->clusterofs;
286
287
return 0;
287
288
}
288
-
erofs_err(sb, "bogus lookback distance %u @ lcn %lu of nid %llu",
289
+
erofs_err(sb, "bogus lookback distance %u @ lcn %llu of nid %llu",
289
290
lookback_distance, m->lcn, vi->nid);
290
291
DBG_BUGON(1);
291
292
return -EFSCORRUPTED;
···
299
300
struct erofs_inode *vi = EROFS_I(inode);
300
301
bool bigpcl1 = vi->z_advise & Z_EROFS_ADVISE_BIG_PCLUSTER_1;
301
302
bool bigpcl2 = vi->z_advise & Z_EROFS_ADVISE_BIG_PCLUSTER_2;
302
-
unsigned long lcn = m->lcn + 1;
303
+
u64 lcn = m->lcn + 1;
303
304
int err;
304
305
305
306
DBG_BUGON(m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD);
···
330
331
m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD);
331
332
332
333
if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD && m->delta[0] != 1) {
333
-
erofs_err(sb, "bogus CBLKCNT @ lcn %lu of nid %llu", lcn, vi->nid);
334
+
erofs_err(sb, "bogus CBLKCNT @ lcn %llu of nid %llu", lcn, vi->nid);
334
335
DBG_BUGON(1);
335
336
return -EFSCORRUPTED;
336
337
}