github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nilfs2: validate directory position after llseek in readdir

Browse Source 
nilfs_readdir() uses ctx->pos, which userspace can set to an arbitrary
value via llseek, as an offset into the directory folio and parses
whatever bytes sit there as a directory entry.  A position pointing
into the middle of an entry -- or at unused bytes of a corrupted image
that the page validator never inspected -- makes dir_emit() copy up to
255 (name_len) bytes from a bogus entry, possibly reading past the end
of the folio and returning unrelated memory contents to userspace.

Snap unaligned positions onto a valid entry boundary by walking the
rec_len chain from the chunk start before parsing, as ext2 does in
ext2_validate_entry().

[ryusuke: fixed offset wrap-around in nilfs_validate_entry() and
 conformed AI tag to guidelines]

Fixes: 2ba466d74e ("nilfs2: directory entry operations")
Assisted-by: Claude:claude-mythos-5
Signed-off-by: Jake Labelle <southampton.jake.labelle@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
This commit is contained in:
Jake Labelle 2026-10-08 20:52:48 +09:00 committed by Viacheslav Dubeyko
parent ef2ccb1554
commit de7f49c125
1 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
fs/nilfs2/dir.c
View File

@ -231,11 +231,27 @@ static struct nilfs_dir_entry *nilfs_next_entry(struct nilfs_dir_entry *p)
nilfs_rec_len_from_disk(p->rec_len));
}
static inline unsigned int
nilfs_validate_entry(char *base, unsigned int offset, unsigned int mask)
{
struct nilfs_dir_entry *de = (struct nilfs_dir_entry *)(base + offset);
struct nilfs_dir_entry *p =
(struct nilfs_dir_entry *)(base + (offset & mask));
while ((char *)p < (char *)de) {
if (p->rec_len == 0)
break;
p = nilfs_next_entry(p);
}
return (char *)p - base;
}
static int nilfs_readdir(struct file *file, struct dir_context *ctx)
{
loff_t pos = ctx->pos;
struct inode *inode = file_inode(file);
struct super_block *sb = inode->i_sb;
unsigned int chunk_size = nilfs_chunk_size(inode);
unsigned int offset = pos & ~PAGE_MASK;
unsigned long n = pos >> PAGE_SHIFT;
unsigned long npages = dir_pages(inode);
@ -254,6 +270,24 @@ static int nilfs_readdir(struct file *file, struct dir_context *ctx)
ctx->pos += PAGE_SIZE - offset;
return -EIO;
}
/*
* ctx->pos comes from userspace via llseek and may point
* into the middle of an entry -- or at unvalidated bytes
* of a crafted image. offset is only nonzero here on the
* very first iteration (subsequent pages always start at
* offset 0, which -- like any chunk boundary -- is always
* a legitimate entry start, since no rec_len chain crosses
* a chunk boundary). Snap a non-chunk-aligned offset onto
* a real entry boundary by walking the chain from the
* enclosing chunk's start, as ext2 does; otherwise
* dir_emit() copies name_len bytes from a fake entry,
* reading past the end of the folio.
*/
if (offset & (chunk_size - 1)) {
offset = nilfs_validate_entry(kaddr, offset,
~(chunk_size - 1));
ctx->pos = ((loff_t)n << PAGE_SHIFT) + offset;
}
de = (struct nilfs_dir_entry *)(kaddr + offset);
limit = kaddr + nilfs_last_byte(inode, n) -
NILFS_DIR_REC_LEN(1);