Unverified Commit 9f143496 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2224 ext4: fix rec_len verify error 

Merge Pull Request from: @ci-robot 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/N7QSEGDDV3SD4WP7NDZSVOSLJZMD3JRI/ 
 
https://gitee.com/openeuler/kernel/issues/I7OXK8 
 
Link:https://gitee.com/openeuler/kernel/pulls/2224

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 0a055904 81ba4581

fs/ext4/namei.c

+15 −11
Original line number Diff line number Diff line
@@ -344,17 +344,17 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, 
						   struct buffer_head *bh)

{

	struct ext4_dir_entry_tail *t;

	int blocksize = EXT4_BLOCK_SIZE(inode->i_sb);



#ifdef PARANOID

	struct ext4_dir_entry *d, *top;



	d = (struct ext4_dir_entry *)bh->b_data;

	top = (struct ext4_dir_entry *)(bh->b_data +

		(EXT4_BLOCK_SIZE(inode->i_sb) -

		 sizeof(struct ext4_dir_entry_tail)));

	while (d < top && d->rec_len)

		(blocksize - sizeof(struct ext4_dir_entry_tail)));

	while (d < top && ext4_rec_len_from_disk(d->rec_len, blocksize))

		d = (struct ext4_dir_entry *)(((void *)d) +

		    le16_to_cpu(d->rec_len));

		    ext4_rec_len_from_disk(d->rec_len, blocksize));



	if (d != top)

		return NULL;
@@ -365,7 +365,8 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, 
#endif



	if (t->det_reserved_zero1 ||

	    le16_to_cpu(t->det_rec_len) != sizeof(struct ext4_dir_entry_tail) ||

	    (ext4_rec_len_from_disk(t->det_rec_len, blocksize) !=

	     sizeof(struct ext4_dir_entry_tail)) ||

	    t->det_reserved_zero2 ||

	    t->det_reserved_ft != EXT4_FT_DIR_CSUM)

		return NULL;
@@ -446,13 +447,14 @@ static struct dx_countlimit *get_dx_countlimit(struct inode *inode, 
	struct ext4_dir_entry *dp;

	struct dx_root_info *root;

	int count_offset;

	int blocksize = EXT4_BLOCK_SIZE(inode->i_sb);

	unsigned int rlen = ext4_rec_len_from_disk(dirent->rec_len, blocksize);



	if (le16_to_cpu(dirent->rec_len) == EXT4_BLOCK_SIZE(inode->i_sb))

	if (rlen == blocksize)

		count_offset = 8;

	else if (le16_to_cpu(dirent->rec_len) == 12) {

	else if (rlen == 12) {

		dp = (struct ext4_dir_entry *)(((void *)dirent) + 12);

		if (le16_to_cpu(dp->rec_len) !=

		    EXT4_BLOCK_SIZE(inode->i_sb) - 12)

		if (ext4_rec_len_from_disk(dp->rec_len, blocksize) != blocksize - 12)

			return NULL;

		root = (struct dx_root_info *)(((void *)dp + 12));

		if (root->reserved_zero ||
@@ -1261,6 +1263,7 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, 
	unsigned int buflen = bh->b_size;

	char *base = bh->b_data;

	struct dx_hash_info h = *hinfo;

	int blocksize = EXT4_BLOCK_SIZE(dir->i_sb);



	if (ext4_has_metadata_csum(dir->i_sb))

		buflen -= sizeof(struct ext4_dir_entry_tail);
@@ -1274,11 +1277,12 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, 
			map_tail--;

			map_tail->hash = h.hash;

			map_tail->offs = ((char *) de - base)>>2;

			map_tail->size = le16_to_cpu(de->rec_len);

			map_tail->size = ext4_rec_len_from_disk(de->rec_len,

								blocksize);

			count++;

			cond_resched();

		}

		de = ext4_next_entry(de, dir->i_sb->s_blocksize);

		de = ext4_next_entry(de, blocksize);

	}

	return count;

}