diff options
| author | Jan Kara <jack@suse.cz> | 2019-12-02 18:02:12 +0100 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2019-12-14 23:22:45 +0100 |
| commit | 64d4ce892383b2ad6d782e080d25502f91bf2a38 (patch) | |
| tree | 2e9096fbc9fe9a449738ae48e395c51e3e7b9429 /fs/select.c | |
| parent | Merge branch 'tt/misc' into dev (diff) | |
| download | linux-64d4ce892383b2ad6d782e080d25502f91bf2a38.tar.xz linux-64d4ce892383b2ad6d782e080d25502f91bf2a38.zip | |
ext4: fix ext4_empty_dir() for directories with holes
Function ext4_empty_dir() doesn't correctly handle directories with
holes and crashes on bh->b_data dereference when bh is NULL. Reorganize
the loop to use 'offset' variable all the times instead of comparing
pointers to current direntry with bh->b_data pointer. Also add more
strict checking of '.' and '..' directory entries to avoid entering loop
in possibly invalid state on corrupted filesystems.
References: CVE-2019-19037
CC: stable@vger.kernel.org
Fixes: 4e19d6b65fb4 ("ext4: allow directory holes")
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20191202170213.4761-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Diffstat (limited to 'fs/select.c')
0 files changed, 0 insertions, 0 deletions