Re: [Patch] Fix another bug in hfsplus when reading a corrupted image

[Eric Sesterhenn <snakebyte@gmx.de>]

* Roman Zippel (zippel@linux-m68k.org) wrote:
> Hi,
> 
> On Tue, 26 Aug 2008, Eric Sesterhenn wrote:
> 
> > Problem is that there is no ext_tree, causing the NULL-pointer
> > dereference in hfsplus_init(). This fixes the issue by checking the ext_tree in
> > hfsplus_get_block() and aborting early enoug.
> 
> The problem is worse, a corrupted extent for the extent file itself may 
> try to get an impossible extent, causing a deadlock if I see it correctly.
> A better fix would be to check the inode number after the first_blocks 
> checks and fail if it's the extent file, as according to the spec the 
> extent file should have no extent for itself.

I guess you had something in mind like this, which also fixes the issue
for me.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>


--- linux/fs/hfsplus/extents.orig	2008-08-26 14:51:08.000000000 +0200
+++ linux/fs/hfsplus/extents.c	2008-09-03 17:58:35.000000000 +0200
@@ -199,6 +199,9 @@ int hfsplus_get_block(struct inode *inod
 		goto done;
 	}
 
+	if (inode->i_ino == HFSPLUS_EXT_CNID)
+		return -EIO;
+
 	mutex_lock(&HFSPLUS_I(inode).extents_lock);
 	res = hfsplus_ext_read_extent(inode, ablock);
 	if (!res) {