diff options
| author | Darrick J. Wong <darrick.wong@oracle.com> | 2018-01-09 20:11:42 +0100 |
|---|---|---|
| committer | Darrick J. Wong <darrick.wong@oracle.com> | 2018-01-09 20:11:42 +0100 |
| commit | 46c59736d8090e602f960aeaf1c6b8292151bf38 (patch) | |
| tree | c1089b30e8b5619e17ea7cd436db78a46b7c6010 /fs | |
| parent | xfs: refactor the geometry structure filling function (diff) | |
| download | linux-46c59736d8090e602f960aeaf1c6b8292151bf38.tar.xz linux-46c59736d8090e602f960aeaf1c6b8292151bf38.zip | |
xfs: harden directory integrity checks some more
If a malicious filesystem image contains a block+ format directory
wherein the directory inode's core.mode is set such that
S_ISDIR(core.mode) == 0, and if there are subdirectories of the
corrupted directory, an attempt to traverse up the directory tree will
crash the kernel in __xfs_dir3_data_check. Running the online scrub's
parent checks will tend to do this.
The crash occurs because the directory inode's d_ops get set to
xfs_dir[23]_nondir_ops (it's not a directory) but the parent pointer
scrubber's indiscriminate call to xfs_readdir proceeds past the ASSERT
if we have non fatal asserts configured.
Fix the null pointer dereference crash in __xfs_dir3_data_check by
looking for S_ISDIR or wrong d_ops; and teach the parent scrubber
to bail out if it is fed a non-directory "parent".
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/xfs/libxfs/xfs_dir2_data.c | 8 | ||||
| -rw-r--r-- | fs/xfs/scrub/parent.c | 2 |
2 files changed, 9 insertions, 1 deletions
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c index 32378122cd1f..853d9abdd545 100644 --- a/fs/xfs/libxfs/xfs_dir2_data.c +++ b/fs/xfs/libxfs/xfs_dir2_data.c @@ -73,6 +73,14 @@ __xfs_dir3_data_check( */ ops = xfs_dir_get_ops(mp, dp); + /* + * If this isn't a directory, or we don't get handed the dir ops, + * something is seriously wrong. Bail out. + */ + if ((dp && !S_ISDIR(VFS_I(dp)->i_mode)) || + ops != xfs_dir_get_ops(mp, NULL)) + return __this_address; + hdr = bp->b_addr; p = (char *)ops->data_entry_p(hdr); diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c index 63a25334fc83..b4d2f8406d22 100644 --- a/fs/xfs/scrub/parent.c +++ b/fs/xfs/scrub/parent.c @@ -171,7 +171,7 @@ xfs_scrub_parent_validate( error = xfs_iget(mp, sc->tp, dnum, 0, 0, &dp); if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, 0, &error)) goto out; - if (dp == sc->ip) { + if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) { xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, 0); goto out_rele; } |