linux/fs/hfs
Phillip Lougher 434a964daa hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops
Clement Lecigne reports a filesystem which causes a kernel oops in
hfs_find_init() trying to dereference sb->ext_tree which is NULL.

This proves to be because the filesystem has a corrupted MDB extent
record, where the extents file does not fit into the first three extents
in the file record (the first blocks).

In hfs_get_block() when looking up the blocks for the extent file
(HFS_EXT_CNID), it fails the first blocks special case, and falls
through to the extent code (which ultimately calls hfs_find_init())
which is in the process of being initialised.

Hfs avoids this scenario by always having the extents b-tree fitting
into the first blocks (the extents B-tree can't have overflow extents).

The fix is to check at mount time that the B-tree fits into first
blocks, i.e.  fail if HFS_I(inode)->alloc_blocks >=
HFS_I(inode)->first_blocks

Note, the existing commit 47f365eb57 ("hfs: fix oops on mount with
corrupted btree extent records") becomes subsumed into this as a special
case, but only for the extents B-tree (HFS_EXT_CNID), it is perfectly
acceptable for the catalog B-Tree file to grow beyond three extents,
with the remaining extent descriptors in the extents overfow.

This fixes CVE-2011-2203

Reported-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Phillip Lougher <plougher@redhat.com>
Cc: Jeff Mahoney <jeffm@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-11-02 16:06:59 -07:00
..
attr.c
bfind.c hfs: Convert tree_lock to mutex 2010-10-12 17:36:11 +02:00
bitmap.c hfs: convert bitmap_lock in a mutex 2008-07-25 10:53:33 -07:00
bnode.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
brec.c hfs_bnode_find() can fail, resulting in hfs_bnode_split() breakage 2008-03-17 09:46:55 -07:00
btree.c hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops 2011-11-02 16:06:59 -07:00
btree.h hfs: Convert tree_lock to mutex 2010-10-12 17:36:11 +02:00
catalog.c hfs: fix a potential buffer overflow 2009-12-15 08:53:10 -08:00
dir.c hfs: remove unnecessary dentry_unhash on rmdir, dir rename 2011-05-28 01:02:52 -04:00
extent.c hfs: convert extents_lock in a mutex 2008-07-25 10:53:33 -07:00
hfs_fs.h fs: change d_hash for rcu-walk 2011-01-07 17:50:20 +11:00
hfs.h address hfs on-disk corruption robustness review comments 2008-02-06 10:41:05 -08:00
inode.c fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
Kconfig fs/Kconfig: move hfs, hfsplus out 2009-01-22 13:15:57 +03:00
Makefile
mdb.c hfs: use sync_dirty_buffer 2010-10-25 21:18:21 -04:00
part_tbl.c
string.c fs: change d_hash for rcu-walk 2011-01-07 17:50:20 +11:00
super.c switch hfs 2011-01-12 20:02:45 -05:00
sysdep.c fs: rcu-walk aware d_revalidate method 2011-01-07 17:50:29 +11:00
trans.c [PATCH] hfs: NLS support 2005-09-07 16:57:50 -07:00