From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Chris Evans <cevans@google.com>,
Jan Kara <jack@suse.cz>
Subject: [PATCH 3.10 04/55] isofs: Fix unbounded recursion when processing relocated directories
Date: Wed, 3 Sep 2014 15:04:54 -0700 [thread overview]
Message-ID: <20140903220454.350652383@linuxfoundation.org> (raw)
In-Reply-To: <20140903220453.653576908@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4 upstream.
We did not check relocated directory in any way when processing Rock
Ridge 'CL' tag. Thus a corrupted isofs image can possibly have a CL
entry pointing to another CL entry leading to possibly unbounded
recursion in kernel code and thus stack overflow or deadlocks (if there
is a loop created from CL entries).
Fix the problem by not allowing CL entry to point to a directory entry
with CL entry (such use makes no good sense anyway) and by checking
whether CL entry doesn't point to itself.
Reported-by: Chris Evans <cevans@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/isofs/inode.c | 15 ++++++++-------
fs/isofs/isofs.h | 23 +++++++++++++++++++----
fs/isofs/rock.c | 39 ++++++++++++++++++++++++++++-----------
3 files changed, 55 insertions(+), 22 deletions(-)
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -69,7 +69,7 @@ static void isofs_put_super(struct super
return;
}
-static int isofs_read_inode(struct inode *);
+static int isofs_read_inode(struct inode *, int relocated);
static int isofs_statfs (struct dentry *, struct kstatfs *);
static struct kmem_cache *isofs_inode_cachep;
@@ -1274,7 +1274,7 @@ out_toomany:
goto out;
}
-static int isofs_read_inode(struct inode *inode)
+static int isofs_read_inode(struct inode *inode, int relocated)
{
struct super_block *sb = inode->i_sb;
struct isofs_sb_info *sbi = ISOFS_SB(sb);
@@ -1419,7 +1419,7 @@ static int isofs_read_inode(struct inode
*/
if (!high_sierra) {
- parse_rock_ridge_inode(de, inode);
+ parse_rock_ridge_inode(de, inode, relocated);
/* if we want uid/gid set, override the rock ridge setting */
if (sbi->s_uid_set)
inode->i_uid = sbi->s_uid;
@@ -1498,9 +1498,10 @@ static int isofs_iget5_set(struct inode
* offset that point to the underlying meta-data for the inode. The
* code below is otherwise similar to the iget() code in
* include/linux/fs.h */
-struct inode *isofs_iget(struct super_block *sb,
- unsigned long block,
- unsigned long offset)
+struct inode *__isofs_iget(struct super_block *sb,
+ unsigned long block,
+ unsigned long offset,
+ int relocated)
{
unsigned long hashval;
struct inode *inode;
@@ -1522,7 +1523,7 @@ struct inode *isofs_iget(struct super_bl
return ERR_PTR(-ENOMEM);
if (inode->i_state & I_NEW) {
- ret = isofs_read_inode(inode);
+ ret = isofs_read_inode(inode, relocated);
if (ret < 0) {
iget_failed(inode);
inode = ERR_PTR(ret);
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -107,7 +107,7 @@ extern int iso_date(char *, int);
struct inode; /* To make gcc happy */
-extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *);
+extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);
@@ -118,9 +118,24 @@ extern struct dentry *isofs_lookup(struc
extern struct buffer_head *isofs_bread(struct inode *, sector_t);
extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);
-extern struct inode *isofs_iget(struct super_block *sb,
- unsigned long block,
- unsigned long offset);
+struct inode *__isofs_iget(struct super_block *sb,
+ unsigned long block,
+ unsigned long offset,
+ int relocated);
+
+static inline struct inode *isofs_iget(struct super_block *sb,
+ unsigned long block,
+ unsigned long offset)
+{
+ return __isofs_iget(sb, block, offset, 0);
+}
+
+static inline struct inode *isofs_iget_reloc(struct super_block *sb,
+ unsigned long block,
+ unsigned long offset)
+{
+ return __isofs_iget(sb, block, offset, 1);
+}
/* Because the inode number is no longer relevant to finding the
* underlying meta-data for an inode, we are free to choose a more
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -288,12 +288,16 @@ eio:
goto out;
}
+#define RR_REGARD_XA 1
+#define RR_RELOC_DE 2
+
static int
parse_rock_ridge_inode_internal(struct iso_directory_record *de,
- struct inode *inode, int regard_xa)
+ struct inode *inode, int flags)
{
int symlink_len = 0;
int cnt, sig;
+ unsigned int reloc_block;
struct inode *reloc;
struct rock_ridge *rr;
int rootflag;
@@ -305,7 +309,7 @@ parse_rock_ridge_inode_internal(struct i
init_rock_state(&rs, inode);
setup_rock_ridge(de, inode, &rs);
- if (regard_xa) {
+ if (flags & RR_REGARD_XA) {
rs.chr += 14;
rs.len -= 14;
if (rs.len < 0)
@@ -485,12 +489,22 @@ repeat:
"relocated directory\n");
goto out;
case SIG('C', 'L'):
- ISOFS_I(inode)->i_first_extent =
- isonum_733(rr->u.CL.location);
- reloc =
- isofs_iget(inode->i_sb,
- ISOFS_I(inode)->i_first_extent,
- 0);
+ if (flags & RR_RELOC_DE) {
+ printk(KERN_ERR
+ "ISOFS: Recursive directory relocation "
+ "is not supported\n");
+ goto eio;
+ }
+ reloc_block = isonum_733(rr->u.CL.location);
+ if (reloc_block == ISOFS_I(inode)->i_iget5_block &&
+ ISOFS_I(inode)->i_iget5_offset == 0) {
+ printk(KERN_ERR
+ "ISOFS: Directory relocation points to "
+ "itself\n");
+ goto eio;
+ }
+ ISOFS_I(inode)->i_first_extent = reloc_block;
+ reloc = isofs_iget_reloc(inode->i_sb, reloc_block, 0);
if (IS_ERR(reloc)) {
ret = PTR_ERR(reloc);
goto out;
@@ -637,9 +651,11 @@ static char *get_symlink_chunk(char *rpn
return rpnt;
}
-int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
+int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode,
+ int relocated)
{
- int result = parse_rock_ridge_inode_internal(de, inode, 0);
+ int flags = relocated ? RR_RELOC_DE : 0;
+ int result = parse_rock_ridge_inode_internal(de, inode, flags);
/*
* if rockridge flag was reset and we didn't look for attributes
@@ -647,7 +663,8 @@ int parse_rock_ridge_inode(struct iso_di
*/
if ((ISOFS_SB(inode->i_sb)->s_rock_offset == -1)
&& (ISOFS_SB(inode->i_sb)->s_rock == 2)) {
- result = parse_rock_ridge_inode_internal(de, inode, 14);
+ result = parse_rock_ridge_inode_internal(de, inode,
+ flags | RR_REGARD_XA);
}
return result;
}
next prev parent reply other threads:[~2014-09-03 22:04 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-03 22:04 [PATCH 3.10 00/55] 3.10.54-stable review Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 01/55] stable_kernel_rules: Add pointer to netdev-FAQ for network patches Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 02/55] HID: logitech: perform bounds checking on device_id early enough Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 03/55] HID: fix a couple of off-by-ones Greg Kroah-Hartman
2014-09-03 22:04 ` Greg Kroah-Hartman [this message]
2014-09-03 22:04 ` [PATCH 3.10 05/55] USB: OHCI: dont lose track of EDs when a controller dies Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 06/55] USB: serial: ftdi_sio: Annotate the current Xsens PID assignments Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 07/55] USB: serial: ftdi_sio: Add support for new Xsens devices Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 08/55] USB: ehci-pci: USB host controller support for Intel Quark X1000 Greg Kroah-Hartman
2014-09-03 22:04 ` [PATCH 3.10 09/55] USB: Fix persist resume of some SS USB devices Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 10/55] ALSA: hda - fix an external mic jack problem on a HP machine Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 11/55] ALSA: virtuoso: add Xonar Essence STX II support Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 12/55] ALSA: hda/ca0132 - Dont try loading firmware at resume when already failed Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 13/55] ALSA: hda/realtek - Avoid setting wrong COEF on ALC269 & co Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 14/55] mei: start disconnect request timer consistently Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 16/55] drm: omapdrm: fix compiler errors Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 17/55] hwmon: (sis5595) Prevent overflow problem when writing large limits Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 18/55] hwmon: (lm78) Fix overflow problems seen when writing large temperature limits Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 19/55] hwmon: (gpio-fan) Prevent overflow problem when writing large limits Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 20/55] hwmon: (ads1015) Fix off-by-one for valid channel index checking Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 21/55] hwmon: (lm85) Fix various errors on attribute writes Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 22/55] hwmon: (ads1015) Fix out-of-bounds array access Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 23/55] hwmon: (dme1737) Prevent overflow problem when writing large limits Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 24/55] drivers/i2c/busses: use correct type for dma_map/unmap Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 25/55] ext4: fix ext4_discard_allocated_blocks() if we cant allocate the pa struct Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 26/55] serial: core: Preserve termios c_cflag for console resume Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 27/55] crypto: ux500 - make interrupt mode plausible Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 28/55] KVM: x86: Inter-privilege level ret emulation is not implemeneted Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 29/55] KVM: x86: always exit on EOIs for interrupts listed in the IOAPIC redir table Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 30/55] KVM: nVMX: fix "acknowledge interrupt on exit" when APICv is in use Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 31/55] Revert "KVM: x86: Increase the number of fixed MTRR regs to 10" Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 32/55] kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601) Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 33/55] ext4: fix BUG_ON in mb_free_blocks() Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 34/55] drm/radeon: add additional SI pci ids Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 35/55] x86: dont exclude low BIOS area when allocating address space for non-PCI cards Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 36/55] x86_64/vsyscall: Fix warn_bad_vsyscall log output Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 38/55] hpsa: fix bad -ENOMEM return value in hpsa_big_passthru_ioctl Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 39/55] Btrfs: fix csum tree corruption, duplicate and outdated checksums Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 40/55] mei: reset client state on queued connect request Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 41/55] mei: nfc: fix memory leak in error path Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 42/55] jbd2: fix infinite loop when recovering corrupt journal blocks Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 43/55] Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 44/55] xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 45/55] usb: xhci: amd chipset also needs short TX quirk Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 46/55] ARM: OMAP2+: hwmod: Rearm wake-up interrupts for DT when MUSB is idled Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 47/55] USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 49/55] USB: whiteheat: Added bounds checking for bulk command response Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 50/55] usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1 Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 51/55] NFSD: Decrease nfsd_users in nfsd_startup_generic fail Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 52/55] svcrdma: Select NFSv4.1 backchannel transport based on forward channel Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 53/55] NFSv3: Fix another acl regression Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 54/55] NFSv4: Fix problems with close in the presence of a delegation Greg Kroah-Hartman
2014-09-03 22:05 ` [PATCH 3.10 55/55] vm_is_stack: use for_each_thread() rather then buggy while_each_thread() Greg Kroah-Hartman
2014-09-03 22:41 ` [PATCH 3.10 00/55] 3.10.54-stable review Greg Kroah-Hartman
2014-09-03 23:44 ` Greg Kroah-Hartman
2014-09-04 4:50 ` Guenter Roeck
2014-09-04 14:02 ` Greg Kroah-Hartman
2014-09-04 13:36 ` Shuah Khan
2014-09-04 13:52 ` Usyskin, Alexander
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140903220454.350652383@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=cevans@google.com \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).