Re: ext3 -> crash -> fsck -> readlink -> oops

[Andreas Dilger <adilger@clusterfs.com>]

On May 16, 2002  19:37 -0700, Andrew Morton wrote:
> You seem have a 4k symlink.   I'd have expected fsck to detect that.

I just took a look (built a simple testcase) and it does not detect
string overflows for long symlinks.  It does for fast symlinks, because
the data is available right away when it is checking the inode data,
but the block data isn't validated at that time, nor later in the run.

> It crashed because vfs_readlink ran off the end of the page.
> 
> --- linux-2.4.19-pre8/fs/namei.c	Thu May  2 17:44:56 2002
> +++ linux-akpm/fs/namei.c	Thu May 16 19:34:57 2002
> @@ -1947,7 +1947,7 @@ int vfs_readlink(struct dentry *dentry, 
>  	if (IS_ERR(link))
>  		goto out;
>  
> -	len = strlen(link);
> +	len = strnlen(link, PAGE_CACHE_SIZE);
>  	if (len > (unsigned) buflen)
>  		len = buflen;
>  	if (copy_to_user(buffer, link, len))

This will fix the oops on behalf of the kernel.  I'm just working on a
patch to e2fsck to fix that side of things.

Cheers, Andreas
--
Andreas Dilger
http://www-mddsp.enel.ucalgary.ca/People/adilger/
http://sourceforge.net/projects/ext2resize/