diff options
| author | Jaegeuk Kim <jaegeuk.kim@samsung.com> | 2014-04-18 15:21:04 +0900 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk.kim@samsung.com> | 2014-05-07 10:21:55 +0900 |
| commit | e8271fa3908de52937d298b339f9f7984c491cc6 (patch) | |
| tree | 12e866c9958e61a4e39a383c94938eb967a50d2c /fs/f2fs | |
| parent | 7ee0eeabcdbb1610d7bc75d1132a43e0c7f7ef28 (diff) | |
| download | linux-e8271fa3908de52937d298b339f9f7984c491cc6.tar.bz2 | |
f2fs: avoid BUG_ON when mouting corrupted image having garbage blocks
If the disk has some garbage blocks, F2FS is able to face with BUG_ON when
recovering direct node blocks.
This patch detects the error case and avoids that prior to reaching BUG_ON.
Alexey Khoroshilov addressed the potential security issues as follows.
"An ability to trigger a BUG_ON assert by mounting a crafted image is
usually considered as a local denial of service [1-3]. As far as I
understand, the reason is that some kernel data may become inconsistent
that can lead to further problems.
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3353
[2] http://www.openwall.com/lists/oss-security/2011/06/24/4
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2928
etc."
Reported-by: Andrey Tsyvarev <tsyvarev@ispras.ru>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
Diffstat (limited to 'fs/f2fs')
| -rw-r--r-- | fs/f2fs/node.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 6ebdba151f12..64755f49d6e7 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -1609,6 +1609,11 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) struct node_info old_ni, new_ni; struct page *ipage; + get_node_info(sbi, ino, &old_ni); + + if (unlikely(old_ni.blk_addr != NULL_ADDR)) + return -EINVAL; + ipage = grab_cache_page(NODE_MAPPING(sbi), ino); if (!ipage) return -ENOMEM; @@ -1616,7 +1621,6 @@ int recover_inode_page(struct f2fs_sb_info *sbi, struct page *page) /* Should not use this inode from free nid list */ remove_free_nid(NM_I(sbi), ino); - get_node_info(sbi, ino, &old_ni); SetPageUptodate(ipage); fill_node_footer(ipage, ino, ino, 0, true); |