Unverified Commit 01c43a22 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10650 xfs: don't walk off the end of a directory data block 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3SNAYQI475HPK5SQ6UYWYWH4KM3JJJMV/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAG8UD 
 
Link:https://gitee.com/openeuler/kernel/pulls/10650

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 2630e077 3b75a8a1

fs/xfs/libxfs/xfs_dir2_data.c

+26 −5
Original line number Diff line number Diff line
@@ -177,6 +177,14 @@ __xfs_dir3_data_check( 
	while (offset < end) {

		struct xfs_dir2_data_unused	*dup = bp->b_addr + offset;

		struct xfs_dir2_data_entry	*dep = bp->b_addr + offset;

		unsigned int	reclen;



		/*

		 * Are the remaining bytes large enough to hold an

		 * unused entry?

		 */

		if (offset > end - xfs_dir2_data_unusedsize(1))

			return __this_address;



		/*

		 * If it's unused, look for the space in the bestfree table.
@@ -186,9 +194,13 @@ __xfs_dir3_data_check( 
		if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {

			xfs_failaddr_t	fa;



			reclen = xfs_dir2_data_unusedsize(

					be16_to_cpu(dup->length));

			if (lastfree != 0)

				return __this_address;

			if (offset + be16_to_cpu(dup->length) > end)

			if (be16_to_cpu(dup->length) != reclen)

				return __this_address;

			if (offset + reclen > end)

				return __this_address;

			if (be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) !=

			    offset)
@@ -206,10 +218,18 @@ __xfs_dir3_data_check( 
				    be16_to_cpu(bf[2].length))

					return __this_address;

			}

			offset += be16_to_cpu(dup->length);

			offset += reclen;

			lastfree = 1;

			continue;

		}



		/*

		 * This is not an unused entry. Are the remaining bytes

		 * large enough for a dirent with a single-byte name?

		 */

		if (offset > end - xfs_dir2_data_entsize(mp, 1))

			return __this_address;



		/*

		 * It's a real entry.  Validate the fields.

		 * If this is a block directory then make sure it's
@@ -218,9 +238,10 @@ __xfs_dir3_data_check( 
		 */

		if (dep->namelen == 0)

			return __this_address;

		if (xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)))

		reclen = xfs_dir2_data_entsize(mp, dep->namelen);

		if (offset + reclen > end)

			return __this_address;

		if (offset + xfs_dir2_data_entsize(mp, dep->namelen) > end)

		if (xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)))

			return __this_address;

		if (be16_to_cpu(*xfs_dir2_data_entry_tag_p(mp, dep)) != offset)

			return __this_address;
@@ -244,7 +265,7 @@ __xfs_dir3_data_check( 
			if (i >= be32_to_cpu(btp->count))

				return __this_address;

		}

		offset += xfs_dir2_data_entsize(mp, dep->namelen);

		offset += reclen;

	}

	/*

	 * Need to have seen all the entries and all the bestfree slots.

fs/xfs/libxfs/xfs_dir2_priv.h

+7 −0
Original line number Diff line number Diff line
@@ -186,6 +186,13 @@ void xfs_dir2_sf_put_ftype(struct xfs_mount *mp, 
extern int xfs_readdir(struct xfs_trans *tp, struct xfs_inode *dp,

		       struct dir_context *ctx, size_t bufsize);



static inline unsigned int

xfs_dir2_data_unusedsize(

	unsigned int	len)

{

	return round_up(len, XFS_DIR2_DATA_ALIGN);

}



static inline unsigned int

xfs_dir2_data_entsize(

	struct xfs_mount	*mp,