From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Rini Date: Fri, 19 Aug 2016 15:54:51 -0400 Subject: [U-Boot] [PATCH] ext4: fix possible crash on directory traversal, ignore deleted entries In-Reply-To: <614f4ec39414464eb4c053438c6f5e9c@rwthex-w2-b.rwth-ad.de> References: <614f4ec39414464eb4c053438c6f5e9c@rwthex-w2-b.rwth-ad.de> Message-ID: <20160819195451.GI5342@bill-the-cat> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On Sun, Aug 14, 2016 at 05:11:04AM +0200, Stefan Br?ns wrote: > The following command triggers a segfault in search_dir: > ./sandbox/u-boot -c 'host bind 0 ./sandbox/test/fs/3GB.ext4.img ; > ext4write host 0 0 /./foo 0x10' > > The following command triggers a segfault in check_filename: > ./sandbox/u-boot -c 'host bind 0 ./sandbox/test/fs/3GB.ext4.img ; > ext4write host 0 0 /. 0x10' > > "." is the first entry in the directory, thus previous_dir is NULL. The > whole previous_dir block in search_dir seems to be a bad copy from > check_filename(...). As the changed data is not written to disk, the > statement is mostly harmless, save the possible NULL-ptr reference. > > Typically a file is unlinked by extending the direntlen of the previous > entry. If the entry is the first entry in the directory block, it is > invalidated by setting inode=0. > > The inode==0 case is hard to trigger without crafted filesystems. It only > hits if the first entry in a directory block is deleted and later a lookup > for the entry (by name) is done. > > Signed-off-by: Stefan Br?ns > --- > fs/ext4/ext4_common.c | 57 ++++++++++++++++++--------------------------------- > fs/ext4/ext4_write.c | 2 +- > include/ext4fs.h | 2 +- > 3 files changed, 22 insertions(+), 39 deletions(-) Can you please add the test case to the existing scripts? Thanks! -- Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: Digital signature URL: