On Thu, Nov 26, 2015 at 08:59:54PM +0000, Artemiy Volkov wrote:
> In check_inode_extra_space(), if we attempt to read an EA header at
> the end of the extra space, in a corrupted filesystem it may result in
> a read beyond the bounds of the inode. Add a check to prevent this.
>
> Reproduced by running ./test_one --valgrind f_write_ea_toobig_extra_isize.
>
> Signed-off-by: Artemiy Volkov <artemiyv@xxxxxxx>
> ---
>
> A quick fix to v1 which wrongly uses spaces instead of tabs.
> Correct a nonexistent struct ext2_inode_large field name used in v2.
>
> e2fsck/pass1.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
> index 0a8e23e..71ea943 100644
> --- a/e2fsck/pass1.c
> +++ b/e2fsck/pass1.c
> @@ -482,6 +482,10 @@ static void check_inode_extra_space(e2fsck_t ctx, struct problem_context *pctx)
> return;
> }
>
> + /* check if there is no place for an EA header */
> + if (inode->i_extra_isize >= max - sizeof(__u32))
> + return;
> +
Looks reasonable enough.
Acked-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
--D
> eamagic = (__u32 *) (((char *) inode) + EXT2_GOOD_OLD_INODE_SIZE +
> inode->i_extra_isize);
> if (*eamagic == EXT2_EXT_ATTR_MAGIC) {
> --
> 1.7.10.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
