leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
d4104c5e78
linux/drivers/staging
History
Gao Xiang d4104c5e78 staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() 
As Al pointed out, "
... and while we are at it, what happens to
	unsigned int nameoff = le16_to_cpu(de[mid].nameoff);
	unsigned int matched = min(startprfx, endprfx);

	struct qstr dname = QSTR_INIT(data + nameoff,
		unlikely(mid >= ndirents - 1) ?
			maxsize - nameoff :
			le16_to_cpu(de[mid + 1].nameoff) - nameoff);

	/* string comparison without already matched prefix */
	int ret = dirnamecmp(name, &dname, &matched);
if le16_to_cpu(de[...].nameoff) is not monotonically increasing?  I.e.
what's to prevent e.g. (unsigned)-1 ending up in dname.len?

Corrupted fs image shouldn't oops the kernel.. "

Revisit the related lookup flow to address the issue.

Fixes: d72d1ce601 ("staging: erofs: add namei functions")
Cc: <stable@vger.kernel.org> # 4.19+
Suggested-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-30 15:31:25 +01:00
..
android staging: android: ion: Support cpu access during dma_buf_detach 2019-01-22 11:38:09 +01:00
axis-fifo staging: axis-fifo: Split line to stay in 80 characters. 2018-11-20 10:59:30 +01:00
board
clocking-wizard
comedi Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
emxx_udc staging: emxx_udc: Remove cast and move all in one line. 2018-12-05 09:44:10 +01:00
erofs staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() 2019-01-30 15:31:25 +01:00
fbtft staging: fbtft: fix strncmp() size warning 2018-12-19 08:29:28 +01:00
fsl-dpaa2 net: core: dev: Add extack argument to dev_open() 2018-12-06 13:26:06 -08:00
fwserial staging: fwserial: convert to DEFINE_SHOW_ATTRIBUTE 2018-12-17 14:24:07 +01:00
gasket staging: gasket: formatting fixes 2018-11-12 14:43:15 -08:00
gdm724x
goldfish staging: goldfish: Add SPDX license identifier. 2018-11-07 12:27:33 +01:00
greybus staging: greybus: convert to DEFINE_SHOW_ATTRIBUTE 2018-12-17 14:24:42 +01:00
gs_fpgaboot
iio Revert "Staging: iio: adt7316: Add an extra check for 'ret' equals to 0" 2018-12-08 11:15:54 +00:00
ks7010 staging: ks7010: remove unnecessary blank line 2018-11-07 12:35:10 +01:00
media Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
most staging: most: sound: replace snprintf with strscpy 2018-12-19 08:28:22 +01:00
mt7621-dma staging: mt7621-dma: fix unbalanced braces 2018-12-17 14:17:28 +01:00
mt7621-dts staging: mt7621-dts: avoid warnings in pinctrl definitions 2018-12-12 11:55:39 +01:00
mt7621-eth cross-tree: phase out dma_zalloc_coherent() 2019-01-08 07:58:37 -05:00
mt7621-mmc staging: mt7621-mmc: Correct spelling mistakes in comments 2018-12-20 18:11:58 +01:00
mt7621-pci staging: mt7621-pci: add comment clarifying inverted reset lines 2018-12-05 09:39:45 +01:00
mt7621-pinctrl staging: mt7621-pinctrl: fix uninitialized variable ngroups 2018-11-11 11:47:38 -08:00
mt7621-spi staging: mt7621-spi: drop support for SPI mode 1/2/3 2018-12-12 11:34:53 +01:00
netlogic
nvec
octeon staging: octeon: fix broken phylib usage 2019-01-30 15:31:24 +01:00
octeon-usb staging: octeon-usb: use a helper function to set the DMA mask 2018-12-05 09:47:02 +01:00
olpc_dcon staging: olpc_dcon: olpc_dcon_xo_1.c: Switch to the gpio descriptor interface 2018-11-08 03:59:47 -08:00
pi433 staging: pi433: add missing call to cdev_del() 2018-12-05 09:39:45 +01:00
rtl8188eu staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 2019-01-15 16:31:09 +01:00
rtl8192e Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
rtl8192u Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
rtl8712 Merge 4.20-rc6 into staging-next 2018-12-10 09:23:50 +01:00
rtl8723bs staging: rtl8723bs: Fix build error with Clang when inlining is disabled 2019-01-18 10:28:44 +01:00
rtlwifi staging: rtlwifi: fix spelling mistake "disnabled" -> "disabled" 2018-12-05 09:39:45 +01:00
rts5208 Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
sm750fb staging: sm750fb: Add spaces around '+' 2018-11-07 12:35:10 +01:00
speakup staging: speakup: change semaphore to completion 2018-12-12 11:31:14 +01:00
unisys Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
vboxvideo Staging/IIO driver patches for 4.21-rc1 2018-12-28 20:39:58 -08:00
vc04_services staging: vchiq: Fix local event signalling 2019-01-15 16:31:09 +01:00
vme
vt6655 cross-tree: phase out dma_zalloc_coherent() 2019-01-08 07:58:37 -05:00
vt6656
wilc1000 Staging: wilc1000: unlock on error in init_chip() 2019-01-15 16:31:09 +01:00
wlan-ng staging: wlan-ng: remove unused variable in prism2fw.c 2018-11-20 10:59:30 +01:00
xgifb staging: xgifb: clean an indentation issue 2018-11-07 12:35:10 +01:00
Kconfig staging: Remove the mt29f_spinand driver 2018-11-06 10:18:48 +01:00
Makefile staging: Remove the mt29f_spinand driver 2018-11-06 10:18:48 +01:00