Re: [PATCH 1/2] f2fs: check name_len of dir entry to prevent from deadloop

[Chao Yu <chao2.yu@samsung.com>]

Hi Jaegeuk,

> -----Original Message-----
> From: Jaegeuk Kim [mailto:jaegeuk@kernel.org]
> Sent: Saturday, July 05, 2014 2:43 PM
> To: Chao Yu
> Cc: Changman Lee; linux-f2fs-devel@lists.sourceforge.net; linux-fsdevel@vger.kernel.org;
> linux-kernel@vger.kernel.org
> Subject: Re: [f2fs-dev][PATCH 1/2] f2fs: check name_len of dir entry to prevent from deadloop
> 
> Hi Chao,
> 
> On Wed, Jul 02, 2014 at 01:23:47PM +0800, Chao Yu wrote:
> > We assume that modification of some special application could result in zeroed
> > name_len, or it is consciously made by somebody. We will deadloop in
> > find_in_block when name_len of dir entry is zero.
> 
> Could you explain this a little bit more?
> I'm not sure how it can happen.

IMO,
On one hand, programs like mkfs/fsck/img2simg and f2fs could directly operate
the raw device, so bugs of these software may be triggered to generate the
corrupt data such as zeroed name_len.
On the other hand, it' could be treated as a potential security problem, because
user could crafted such a malicious image include zeroed name_len for hacking purpose.
Once such special image is being mounted, deadloop could be triggered, finally will
result in effecting on linux system's running.

Thanks,
Yu

> I think the zeroed name_len would cause some problems in f2fs_add_link.
> 
> Thanks,
> 
> >
> > This patch is added for preventing deadloop in above scenario.
> >
> > Signed-off-by: Chao Yu <chao2.yu@samsung.com>
> > ---
> >  fs/f2fs/dir.c |   10 ++++++++++
> >  1 file changed, 10 insertions(+)
> >
> > diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
> > index be8c7af..4316ec5 100644
> > --- a/fs/f2fs/dir.c
> > +++ b/fs/f2fs/dir.c
> > @@ -121,6 +121,16 @@ static struct f2fs_dir_entry *find_in_block(struct page *dentry_page,
> >  			}
> >  		}
> >
> > +		/* check name_len to prevent from deadloop here */
> > +		if (unlikely(de->name_len == 0)) {
> > +			struct inode *inode = dentry_page->mapping->host;
> > +
> > +			f2fs_msg(inode->i_sb, KERN_ERR,
> > +				"zero-length dir entry, ino = %lu, name = %s",
> > +				(unsigned long)inode->i_ino, name->name);
> > +			break;
> > +		}
> > +
> >  		bit_start = bit_pos
> >  				+ GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
> >  	}
> > --
> > 1.7.9.5
> 
> --
> Jaegeuk Kim


------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft