summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorIan Ray <ian.ray@ge.com>2017-11-08 15:35:10 +0000
committerStefano Babic <sbabic@denx.de>2017-11-20 09:58:31 +0100
commitecdfb4195b20eb2dcde3c4083170016c13c69e8b (patch)
tree7781fc0c6a8fa9e6c3019fd369e1570a45db13cb /fs
parent2feec4eafd40b4b121a0f7d7f602e25a39d9d403 (diff)
ext4: recover from filesystem corruption when reading
Some fixes when reading EXT files and directory entries were identified after using e2fuzz to corrupt an EXT3 filesystem: - Stop reading directory entries if the offset becomes badly aligned. - Avoid overwriting memory by clamping the length used to zero the buffer in ext4fs_read_file. Also sanity check blocksize. Signed-off-by: Ian Ray <ian.ray@ge.com> Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk> Reviewed-by: Stefano Babic <sbabic@denx.de>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/ext4_common.c10
-rw-r--r--fs/ext4/ext4fs.c10
2 files changed, 19 insertions, 1 deletions
diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index 31952f48b90..dac95453650 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -660,6 +660,11 @@ static int search_dir(struct ext2_inode *parent_inode, char *dirname)
offset = 0;
do {
+ if (offset & 3) {
+ printf("Badly aligned ext2_dirent\n");
+ break;
+ }
+
dir = (struct ext2_dirent *)(block_buffer + offset);
direntname = (char*)(dir) + sizeof(struct ext2_dirent);
@@ -880,6 +885,11 @@ static int unlink_filename(char *filename, unsigned int blknr)
offset = 0;
do {
+ if (offset & 3) {
+ printf("Badly aligned ext2_dirent\n");
+ break;
+ }
+
previous_dir = dir;
dir = (struct ext2_dirent *)(block_buffer + offset);
direntname = (char *)(dir) + sizeof(struct ext2_dirent);
diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c
index b0c7303aa41..9ee2caf2fa1 100644
--- a/fs/ext4/ext4fs.c
+++ b/fs/ext4/ext4fs.c
@@ -64,6 +64,9 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
char *delayed_buf = NULL;
short status;
+ if (blocksize <= 0)
+ return -1;
+
/* Adjust len so it we can't read past the end of the file. */
if (len + pos > filesize)
len = (filesize - pos);
@@ -127,6 +130,7 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
(blockend >> log2blksz);
}
} else {
+ int n;
if (previous_block_number != -1) {
/* spill */
status = ext4fs_devread(delayed_start,
@@ -137,7 +141,11 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
return -1;
previous_block_number = -1;
}
- memset(buf, 0, blocksize - skipfirst);
+ /* Zero no more than `len' bytes. */
+ n = blocksize - skipfirst;
+ if (n > len)
+ n = len;
+ memset(buf, 0, n);
}
buf += blocksize - skipfirst;
}