Fixes for 4.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch b/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch
new file mode 100644 (file)
index 0000000..20dd3b6
--- /dev/null
+++ b/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch
@@ -0,0 +1,38 @@
+From 581f11fd808165551f0c584cf2a28a8fc04652e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 15:02:34 +0800
+Subject: f2fs: check if file namelen exceeds max value
+
+From: Sheng Yong <shengyong1@huawei.com>
+
+[ Upstream commit 720db068634c91553a8e1d9a0fcd8c7050e06d2b ]
+
+Dentry bitmap is not enough to detect incorrect dentries. So this patch
+also checks the namelen value of a dentry.
+
+Signed-off-by: Gong Chen <gongchen4@huawei.com>
+Signed-off-by: Sheng Yong <shengyong1@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/dir.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 5411d6667781f..e2ff0eb16f89c 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -807,7 +807,8 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ 
+               /* check memory boundary before moving forward */
+               bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
+-              if (unlikely(bit_pos > d->max)) {
++              if (unlikely(bit_pos > d->max ||
++                              le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) {
+                       f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING,
+                               "%s: corrupted namelen=%d, run fsck to fix.",
+                               __func__, le16_to_cpu(de->name_len));
+-- 
+2.25.1
+

diff --git a/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch b/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch
new file mode 100644 (file)
index 0000000..9898bdf
--- /dev/null
+++ b/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch
@@ -0,0 +1,51 @@
+From b48b9b369861e483764f96a4c443ea974db7fc61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 12:40:30 -0800
+Subject: f2fs: check memory boundary by insane namelen
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 4e240d1bab1ead280ddf5eb05058dba6bbd57d10 ]
+
+If namelen is corrupted to have very long value, fill_dentries can copy
+wrong memory area.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/dir.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 92a240616f520..5411d6667781f 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -805,6 +805,16 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+               de_name.name = d->filename[bit_pos];
+               de_name.len = le16_to_cpu(de->name_len);
+ 
++              /* check memory boundary before moving forward */
++              bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
++              if (unlikely(bit_pos > d->max)) {
++                      f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING,
++                              "%s: corrupted namelen=%d, run fsck to fix.",
++                              __func__, le16_to_cpu(de->name_len));
++                      set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK);
++                      return -EINVAL;
++              }
++
+               if (f2fs_encrypted_inode(d->inode)) {
+                       int save_len = fstr->len;
+                       int ret;
+@@ -829,7 +839,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+                                       le32_to_cpu(de->ino), d_type))
+                       return true;
+ 
+-              bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
+               ctx->pos = start_pos + bit_pos;
+       }
+       return false;
+-- 
+2.25.1
+

diff --git a/queue-4.4/series b/queue-4.4/series
index d633d554aa30ad626c679d3378b5c42726921855..e2240b7f1951bca4c0fe11547b7ce4019e80e57a 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -10,3 +10,5 @@ random32-update-the-net-random-state-on-interrupt-and-activity.patch
 drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch
 drm-hold-gem-reference-until-object-is-no-longer-accessed.patch
 arm-percpu.h-fix-build-error.patch
+f2fs-check-memory-boundary-by-insane-namelen.patch
+f2fs-check-if-file-namelen-exceeds-max-value.patch