Unverified Commit 4ddbdf20 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9747 CVE-2024-39469 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yu Liao <liaoyu15@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LMLPMZ52JUA7KM4K5XSWJXUZLXUPNBSD/ 
CVE-2024-39469

Matthew Wilcox (Oracle) (1):
  nilfs2: return the mapped address from nilfs_get_page()

Ryusuke Konishi (1):
  nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors


-- 
2.33.0
 
https://gitee.com/src-openeuler/kernel/issues/IA8AIS 
 
Link:https://gitee.com/openeuler/kernel/pulls/9747

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
parents 99173a87 56a18848

fs/nilfs2/dir.c

+28 −31
Original line number Diff line number Diff line
@@ -186,19 +186,24 @@ static bool nilfs_check_page(struct page *page) 
	return false;

}



static struct page *nilfs_get_page(struct inode *dir, unsigned long n)

static void *nilfs_get_page(struct inode *dir, unsigned long n,

		struct page **pagep)

{

	struct address_space *mapping = dir->i_mapping;

	struct page *page = read_mapping_page(mapping, n, NULL);

	void *kaddr;



	if (IS_ERR(page))

		return page;



	if (!IS_ERR(page)) {

		kmap(page);

	kaddr = kmap(page);

	if (unlikely(!PageChecked(page))) {

		if (PageError(page) || !nilfs_check_page(page))

			goto fail;

	}

	}

	return page;



	*pagep = page;

	return kaddr;



fail:

	nilfs_put_page(page);
@@ -275,14 +280,14 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx) 
	for ( ; n < npages; n++, offset = 0) {

		char *kaddr, *limit;

		struct nilfs_dir_entry *de;

		struct page *page = nilfs_get_page(inode, n);

		struct page *page;



		if (IS_ERR(page)) {

		kaddr = nilfs_get_page(inode, n, &page);

		if (IS_ERR(kaddr)) {

			nilfs_error(sb, "bad page in #%lu", inode->i_ino);

			ctx->pos += PAGE_SIZE - offset;

			return -EIO;

		}

		kaddr = page_address(page);

		de = (struct nilfs_dir_entry *)(kaddr + offset);

		limit = kaddr + nilfs_last_byte(inode, n) -

			NILFS_DIR_REC_LEN(1);
@@ -345,11 +350,9 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, 
		start = 0;

	n = start;

	do {

		char *kaddr;

		char *kaddr = nilfs_get_page(dir, n, &page);



		page = nilfs_get_page(dir, n);

		if (!IS_ERR(page)) {

			kaddr = page_address(page);

		if (!IS_ERR(kaddr)) {

			de = (struct nilfs_dir_entry *)kaddr;

			kaddr += nilfs_last_byte(dir, n) - reclen;

			while ((char *) de <= kaddr) {
@@ -387,15 +390,11 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, 


struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)

{

	struct page *page = nilfs_get_page(dir, 0);

	struct nilfs_dir_entry *de = NULL;

	struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p);



	if (!IS_ERR(page)) {

		de = nilfs_next_entry(

			(struct nilfs_dir_entry *)page_address(page));

		*p = page;

	}

	return de;

	if (IS_ERR(de))

		return NULL;

	return nilfs_next_entry(de);

}



ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)
@@ -459,12 +458,11 @@ int nilfs_add_link(struct dentry *dentry, struct inode *inode) 
	for (n = 0; n <= npages; n++) {

		char *dir_end;



		page = nilfs_get_page(dir, n);

		err = PTR_ERR(page);

		if (IS_ERR(page))

		kaddr = nilfs_get_page(dir, n, &page);

		err = PTR_ERR(kaddr);

		if (IS_ERR(kaddr))

			goto out;

		lock_page(page);

		kaddr = page_address(page);

		dir_end = kaddr + nilfs_last_byte(dir, n);

		de = (struct nilfs_dir_entry *)kaddr;

		kaddr += PAGE_SIZE - reclen;
@@ -627,11 +625,10 @@ int nilfs_empty_dir(struct inode *inode) 
		char *kaddr;

		struct nilfs_dir_entry *de;



		page = nilfs_get_page(inode, i);

		if (IS_ERR(page))

			continue;

		kaddr = nilfs_get_page(inode, i, &page);

		if (IS_ERR(kaddr))

			return 0;



		kaddr = page_address(page);

		de = (struct nilfs_dir_entry *)kaddr;

		kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);