Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=80eb68d23897126e7f25e2b3689bc27fb8cdde17
Commit:     80eb68d23897126e7f25e2b3689bc27fb8cdde17
Parent:     a6cd6bf9f8cab154a4a086fe786bd7422954d8dc
Author:     Lepton Wu <[EMAIL PROTECTED]>
AuthorDate: Tue Oct 16 23:29:50 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Wed Oct 17 08:42:57 2007 -0700

    reiserfs: fix kernel panic on corrupted directory
    
    When reading corrupted reiserfs directory data, d_reclen could be a
    negative number or a big positive number, this can lead to kernel panic or
    oop.  The following patch adds a sanity check.
    
    Signed-off-by: Lepton Wu <[EMAIL PROTECTED]>
    Cc: Chris Mason <[EMAIL PROTECTED]>
    Cc: Jeff Mahoney <[EMAIL PROTECTED]>
    Cc: "Vladimir V. Saveliev" <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 fs/reiserfs/dir.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index ffbfc2c..e6b03d2 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -121,6 +121,16 @@ static int reiserfs_readdir(struct file *filp, void 
*dirent, filldir_t filldir)
                                        continue;
                                d_reclen = entry_length(bh, ih, entry_num);
                                d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh);
+
+                               if (d_reclen <= 0 ||
+                                   d_name + d_reclen > bh->b_data + 
bh->b_size) {
+                                       /* There is corrupted data in entry,
+                                        * We'd better stop here */
+                                       pathrelse(&path_to_entry);
+                                       ret = -EIO;
+                                       goto out;
+                               }
+
                                if (!d_name[d_reclen - 1])
                                        d_reclen = strlen(d_name);
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to