Unverified Commit 89624e1e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10786 CVE-2024-41034 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhihao Cheng <chengzhihao@huaweicloud.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ASN57OOPSWEVVDOG76IAZZ2UZZOTFAQ6/ 
Matthew Wilcox (Oracle) (2):
  nilfs2: Remove check for PageError
  nilfs2: return the mapped address from nilfs_get_page()

Ryusuke Konishi (1):
  nilfs2: fix kernel bug on rename operation of broken directory


-- 
2.31.1
 
https://gitee.com/src-openeuler/kernel/issues/IAGEKP 
 
Link:https://gitee.com/openeuler/kernel/pulls/10786

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents c84d316d 423a5f31

fs/nilfs2/dir.c

+54 −29
Original line number Diff line number Diff line
@@ -192,19 +192,24 @@ static bool nilfs_check_page(struct page *page) 
	return false;

}



static struct page *nilfs_get_page(struct inode *dir, unsigned long n)

static void *nilfs_get_page(struct inode *dir, unsigned long n,

		struct page **pagep)

{

	struct address_space *mapping = dir->i_mapping;

	struct page *page = read_mapping_page(mapping, n, NULL);

	void *kaddr;



	if (IS_ERR(page))

		return page;



	if (!IS_ERR(page)) {

		kmap(page);

	kaddr = kmap(page);

	if (unlikely(!PageChecked(page))) {

			if (PageError(page) || !nilfs_check_page(page))

		if (!nilfs_check_page(page))

			goto fail;

	}

	}

	return page;



	*pagep = page;

	return kaddr;



fail:

	nilfs_put_page(page);
@@ -281,14 +286,14 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx) 
	for ( ; n < npages; n++, offset = 0) {

		char *kaddr, *limit;

		struct nilfs_dir_entry *de;

		struct page *page = nilfs_get_page(inode, n);

		struct page *page;



		if (IS_ERR(page)) {

		kaddr = nilfs_get_page(inode, n, &page);

		if (IS_ERR(kaddr)) {

			nilfs_error(sb, "bad page in #%lu", inode->i_ino);

			ctx->pos += PAGE_SIZE - offset;

			return -EIO;

		}

		kaddr = page_address(page);

		de = (struct nilfs_dir_entry *)(kaddr + offset);

		limit = kaddr + nilfs_last_byte(inode, n) -

			NILFS_DIR_REC_LEN(1);
@@ -351,11 +356,9 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, 
		start = 0;

	n = start;

	do {

		char *kaddr;

		char *kaddr = nilfs_get_page(dir, n, &page);



		page = nilfs_get_page(dir, n);

		if (!IS_ERR(page)) {

			kaddr = page_address(page);

		if (!IS_ERR(kaddr)) {

			de = (struct nilfs_dir_entry *)kaddr;

			kaddr += nilfs_last_byte(dir, n) - reclen;

			while ((char *) de <= kaddr) {
@@ -393,15 +396,39 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, 


struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)

{

	struct page *page = nilfs_get_page(dir, 0);

	struct nilfs_dir_entry *de = NULL;

	struct page *page;

	struct nilfs_dir_entry *de, *next_de;

	size_t limit;

	char *msg;



	if (!IS_ERR(page)) {

		de = nilfs_next_entry(

			(struct nilfs_dir_entry *)page_address(page));

		*p = page;

	de = nilfs_get_page(dir, 0, &page);

	if (IS_ERR(de))

		return NULL;



	limit = nilfs_last_byte(dir, 0);  /* is a multiple of chunk size */

	if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino ||

		     !nilfs_match(1, ".", de))) {

		msg = "missing '.'";

		goto fail;

	}

	return de;



	next_de = nilfs_next_entry(de);

	/*

	 * If "next_de" has not reached the end of the chunk, there is

	 * at least one more record.  Check whether it matches "..".

	 */

	if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) ||

		     !nilfs_match(2, "..", next_de))) {

		msg = "missing '..'";

		goto fail;

	}

	*p = page;

	return next_de;



fail:

	nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg);

	nilfs_put_page(page);

	return NULL;

}



ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)
@@ -465,12 +492,11 @@ int nilfs_add_link(struct dentry *dentry, struct inode *inode) 
	for (n = 0; n <= npages; n++) {

		char *dir_end;



		page = nilfs_get_page(dir, n);

		err = PTR_ERR(page);

		if (IS_ERR(page))

		kaddr = nilfs_get_page(dir, n, &page);

		err = PTR_ERR(kaddr);

		if (IS_ERR(kaddr))

			goto out;

		lock_page(page);

		kaddr = page_address(page);

		dir_end = kaddr + nilfs_last_byte(dir, n);

		de = (struct nilfs_dir_entry *)kaddr;

		kaddr += PAGE_SIZE - reclen;
@@ -633,11 +659,10 @@ int nilfs_empty_dir(struct inode *inode) 
		char *kaddr;

		struct nilfs_dir_entry *de;



		page = nilfs_get_page(inode, i);

		if (IS_ERR(page))

		kaddr = nilfs_get_page(inode, i, &page);

		if (IS_ERR(kaddr))

			continue;



		kaddr = page_address(page);

		de = (struct nilfs_dir_entry *)kaddr;

		kaddr += nilfs_last_byte(inode, i) - NILFS_DIR_REC_LEN(1);