Unverified Commit be251396 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13049 ext4: some dependencies of CVE-2024-47701 

Merge Pull Request from: @ci-robot 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/REAMN6DBV2Q2T32LO642D47MEIJLM7E5/ 
Thadeu Lima de Souza Cascardo (2):
  ext4: ext4_search_dir should return a proper error
  ext4: explicitly exit when ext4_find_inline_entry returns an error


-- 
2.46.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYPK6 
 
Link:https://gitee.com/openeuler/kernel/pulls/13049

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 7cb2e2ed c5e1af0f

fs/ext4/namei.c

+8 −6
Original line number Diff line number Diff line
@@ -1526,7 +1526,7 @@ static bool ext4_match(struct inode *parent, 
}



/*

 * Returns 0 if not found, -1 on failure, and 1 on success

 * Returns 0 if not found, -EFSCORRUPTED on failure, and 1 on success

 */

int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,

		    struct inode *dir, struct ext4_filename *fname,
@@ -1547,7 +1547,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, 
			 * a full check */

			if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,

						 buf_size, offset))

				return -1;

				return -EFSCORRUPTED;

			*res_dir = de;

			return 1;

		}
@@ -1555,7 +1555,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, 
		de_len = ext4_rec_len_from_disk(de->rec_len,

						dir->i_sb->s_blocksize);

		if (de_len <= 0)

			return -1;

			return -EFSCORRUPTED;

		offset += de_len;

		de = (struct ext4_dir_entry_2 *) ((char *) de + de_len);

	}
@@ -1618,7 +1618,7 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir, 
					     &has_inline_data);

		if (inlined)

			*inlined = has_inline_data;

		if (has_inline_data)

		if (has_inline_data || IS_ERR(ret))

			goto cleanup_and_exit;

	}
@@ -1707,9 +1707,11 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir, 
			goto cleanup_and_exit;

		} else {

			brelse(bh);

			if (i < 0)

			if (i < 0) {

				ret = ERR_PTR(i);

				goto cleanup_and_exit;

			}

		}

	next:

		if (++block >= nblocks)

			block = 0;
@@ -1803,7 +1805,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir, 
		if (retval == 1)

			goto success;

		brelse(bh);

		if (retval == -1) {

		if (retval < 0) {

			bh = ERR_PTR(ERR_BAD_DX_DIR);

			goto errout;

		}