imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-31 14:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

ocfs2: add boundary check to ocfs2_check_dir_entry()

Browse Source 
In 'ocfs2_check_dir_entry()', add extra check whether at least the
smallest possible dirent may be located at the specified offset within
bh's data, thus preventing an out-of-bounds accesses below.

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Dmitry Antipov <[email protected]>
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=b20bbf680bb0f2ecedae
Reviewed-by: Heming Zhao <[email protected]>
Cc: Joseph Qi <[email protected]>
Cc: Mark Fasheh <[email protected]>
Cc: Joel Becker <[email protected]>
Cc: Junxiao Bi <[email protected]>
Cc: Changwei Ge <[email protected]>
Cc: Jun Piao <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
This commit is contained in:
Dmitry Antipov authored and Andrew Morton committed 2025-11-12 10:00:16 -08:00
1 parent d99dc586ca
commit 390ac56cf0
1 file changed
+15 -2
Download Patch File Download Diff File Expand all files Collapse all files
fs/ocfs2/dir.c
+15 -2
View File
@@ -302,8 +302,21 @@ static int ocfs2_check_dir_entry(struct inode *dir,
unsigned long offset)
{
const char *error_msg = NULL;
const int rlen = le16_to_cpu(de->rec_len);
const unsigned long next_offset = ((char *) de - buf) + rlen;
unsigned long next_offset;
int rlen;
if (offset > size - OCFS2_DIR_REC_LEN(1)) {
/* Dirent is (maybe partially) beyond the buffer
* boundaries so touching 'de' members is unsafe.
*/
mlog(ML_ERROR, "directory entry (#%llu: offset=%lu) "
"too close to end or out-of-bounds",
(unsigned long long)OCFS2_I(dir)->ip_blkno, offset);
return 0;
}
rlen = le16_to_cpu(de->rec_len);
next_offset = ((char *) de - buf) + rlen;
if (unlikely(rlen < OCFS2_DIR_REC_LEN(1)))
error_msg = "rec_len is smaller than minimal";