From: Sasha Levin Date: Sat, 1 Aug 2020 14:19:37 +0000 (-0400) Subject: Fixes for 4.4 X-Git-Tag: v5.7.13~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bb7239ee7e10eec9a90b4b95642738bb9c83da90;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch b/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch new file mode 100644 index 00000000000..20dd3b69458 --- /dev/null +++ b/queue-4.4/f2fs-check-if-file-namelen-exceeds-max-value.patch @@ -0,0 +1,38 @@ +From 581f11fd808165551f0c584cf2a28a8fc04652e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jan 2019 15:02:34 +0800 +Subject: f2fs: check if file namelen exceeds max value + +From: Sheng Yong + +[ Upstream commit 720db068634c91553a8e1d9a0fcd8c7050e06d2b ] + +Dentry bitmap is not enough to detect incorrect dentries. So this patch +also checks the namelen value of a dentry. + +Signed-off-by: Gong Chen +Signed-off-by: Sheng Yong +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 5411d6667781f..e2ff0eb16f89c 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -807,7 +807,8 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, + + /* check memory boundary before moving forward */ + bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); +- if (unlikely(bit_pos > d->max)) { ++ if (unlikely(bit_pos > d->max || ++ le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) { + f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING, + "%s: corrupted namelen=%d, run fsck to fix.", + __func__, le16_to_cpu(de->name_len)); +-- +2.25.1 + diff --git a/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch b/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch new file mode 100644 index 00000000000..9898bdf5103 --- /dev/null +++ b/queue-4.4/f2fs-check-memory-boundary-by-insane-namelen.patch @@ -0,0 +1,51 @@ +From b48b9b369861e483764f96a4c443ea974db7fc61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 12:40:30 -0800 +Subject: f2fs: check memory boundary by insane namelen + +From: Jaegeuk Kim + +[ Upstream commit 4e240d1bab1ead280ddf5eb05058dba6bbd57d10 ] + +If namelen is corrupted to have very long value, fill_dentries can copy +wrong memory area. + +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/dir.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 92a240616f520..5411d6667781f 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -805,6 +805,16 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, + de_name.name = d->filename[bit_pos]; + de_name.len = le16_to_cpu(de->name_len); + ++ /* check memory boundary before moving forward */ ++ bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); ++ if (unlikely(bit_pos > d->max)) { ++ f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING, ++ "%s: corrupted namelen=%d, run fsck to fix.", ++ __func__, le16_to_cpu(de->name_len)); ++ set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK); ++ return -EINVAL; ++ } ++ + if (f2fs_encrypted_inode(d->inode)) { + int save_len = fstr->len; + int ret; +@@ -829,7 +839,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, + le32_to_cpu(de->ino), d_type)) + return true; + +- bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); + ctx->pos = start_pos + bit_pos; + } + return false; +-- +2.25.1 + diff --git a/queue-4.4/series b/queue-4.4/series index d633d554aa3..e2240b7f195 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -10,3 +10,5 @@ random32-update-the-net-random-state-on-interrupt-and-activity.patch drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch drm-hold-gem-reference-until-object-is-no-longer-accessed.patch arm-percpu.h-fix-build-error.patch +f2fs-check-memory-boundary-by-insane-namelen.patch +f2fs-check-if-file-namelen-exceeds-max-value.patch