Hi Ted, We came across a corruption in which e_value_offs for an in-inode EA was corrupt and the overflow was causing a segfault. We should validate e_value_offs for in-inode EAs as well. I have also attached the regression test for this problem. Signed-off-by: Girish Shilamkar <girish.shilamkar@xxxxxxx> -- Thanks, Girish
Index: e2fsprogs-1.41.1/e2fsck/pass1.c =================================================================== --- e2fsprogs-1.41.1.orig/e2fsck/pass1.c 2008-08-28 19:56:31.000000000 +0530 +++ e2fsprogs-1.41.1/e2fsck/pass1.c 2009-02-04 16:21:14.000000000 +0530 @@ -318,6 +318,13 @@ goto fix; } + /* Value size cannot be larger than EA space in inode */ + if (entry->e_value_offs > storage_size || + entry->e_value_offs + entry->e_value_size > storage_size) { + problem = PR_1_INODE_EA_BAD_VALUE; + goto fix; + } + hash = ext2fs_ext_attr_hash_entry(entry, start + entry->e_value_offs); Index: e2fsprogs-1.41.1/e2fsck/problem.c =================================================================== --- e2fsprogs-1.41.1.orig/e2fsck/problem.c 2008-08-28 19:56:31.000000000 +0530 +++ e2fsprogs-1.41.1/e2fsck/problem.c 2009-02-04 16:20:06.000000000 +0530 @@ -908,6 +908,11 @@ N_("Pass 1C: Scanning directories for @is with @m @bs\n"), PROMPT_NONE, 0 }, + /* Bad extended attribute value in inode */ + { PR_1_INODE_EA_BAD_VALUE, + N_("@a in @i %i is corrupt (@n value)."), + PROMPT_CLEAR, 0}, + /* Pass 1D: Reconciling multiply-claimed blocks */ { PR_1D_PASS_HEADER, Index: e2fsprogs-1.41.1/e2fsck/problem.h =================================================================== --- e2fsprogs-1.41.1.orig/e2fsck/problem.h 2008-08-28 08:37:00.000000000 +0530 +++ e2fsprogs-1.41.1/e2fsck/problem.h 2009-02-04 16:20:06.000000000 +0530 @@ -560,6 +560,9 @@ /* Couldn't clone file (error) */ #define PR_1D_CLONE_ERROR 0x013008 +/* Bad extended attribute value in inode */ +#define PR_1_INODE_EA_BAD_VALUE 0x01006D + /* * Pass 2 errors */
Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.1 =================================================================== --- /dev/null +++ e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.1 @@ -0,0 +1,11 @@ +Pass 1: Checking inodes, blocks, and sizes +Extended attribute in inode 13 is corrupt (invalid value).Clear? yes + +Pass 2: Checking directory structure +Pass 3: Checking directory connectivity +Pass 4: Checking reference counts +Pass 5: Checking group summary information + +test_filesys: ***** FILE SYSTEM WAS MODIFIED ***** +test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks +Exit status is 1 Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.2 =================================================================== --- /dev/null +++ e2fsprogs-1.41.1/tests/f_bad_ea_value/expect.2 @@ -0,0 +1,7 @@ +Pass 1: Checking inodes, blocks, and sizes +Pass 2: Checking directory structure +Pass 3: Checking directory connectivity +Pass 4: Checking reference counts +Pass 5: Checking group summary information +test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks +Exit status is 0 Index: e2fsprogs-1.41.1/tests/f_bad_ea_value/name =================================================================== --- /dev/null +++ e2fsprogs-1.41.1/tests/f_bad_ea_value/name @@ -0,0 +1 @@ +invalid value of in-inode EA offset --- /dev/null 2009-02-04 10:39:50.420557047 +0530 +++ e2fsprogs-1.41.1/tests/f_bad_ea_value/image.gz 2009-02-04 13:21:18.000000000 +0530 @@ -0,0 +1,4 @@ +��image �|u�� �`�,�A@�� $���������r����'����d� 3����`��RCr6�,5����,�i���7�wI�%�>*-)͇'^��)��+N�M�q��;�>ԧ���~�<}�M�n�m��1o�ܷ����N3�S��͔fN��Y�i���]��