ext4: recover from filesystem corruption when reading

Some fixes when reading EXT files and directory entries were identified
after using e2fuzz to corrupt an EXT3 filesystem:

 - Stop reading directory entries if the offset becomes badly aligned.

 - Avoid overwriting memory by clamping the length used to zero the buffer
   in ext4fs_read_file.  Also sanity check blocksize.

Signed-off-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Reviewed-by: Stefano Babic <sbabic@denx.de>

diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index 31952f48b90d50b3af6c119540247a486b596a99..dac95453650c042ef2cc071b9a6ac94a8f007d5f 100644 (file)
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -660,6 +660,11 @@ static int search_dir(struct ext2_inode *parent_inode, char *dirname)
 
                offset = 0;
                do {
+                       if (offset & 3) {
+                               printf("Badly aligned ext2_dirent\n");
+                               break;
+                       }
+
                        dir = (struct ext2_dirent *)(block_buffer + offset);
                        direntname = (char*)(dir) + sizeof(struct ext2_dirent);
 
@@ -880,6 +885,11 @@ static int unlink_filename(char *filename, unsigned int blknr)
 
        offset = 0;
        do {
+               if (offset & 3) {
+                       printf("Badly aligned ext2_dirent\n");
+                       break;
+               }
+
                previous_dir = dir;
                dir = (struct ext2_dirent *)(block_buffer + offset);
                direntname = (char *)(dir) + sizeof(struct ext2_dirent);

diff --git a/fs/ext4/ext4fs.c b/fs/ext4/ext4fs.c
index b0c7303aa410034fc6091a2a56d02f75def6936a..9ee2caf2fa1a7d6db2395e0e98d0f03be2e2091d 100644 (file)
--- a/fs/ext4/ext4fs.c
+++ b/fs/ext4/ext4fs.c
@@ -64,6 +64,9 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
        char *delayed_buf = NULL;
        short status;
 
+       if (blocksize <= 0)
+               return -1;
+
        /* Adjust len so it we can't read past the end of the file. */
        if (len + pos > filesize)
                len = (filesize - pos);
@@ -127,6 +130,7 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
                                        (blockend >> log2blksz);
                        }
                } else {
+                       int n;
                        if (previous_block_number != -1) {
                                /* spill */
                                status = ext4fs_devread(delayed_start,
@@ -137,7 +141,11 @@ int ext4fs_read_file(struct ext2fs_node *node, loff_t pos,
                                        return -1;
                                previous_block_number = -1;
                        }
-                       memset(buf, 0, blocksize - skipfirst);
+                       /* Zero no more than `len' bytes. */
+                       n = blocksize - skipfirst;
+                       if (n > len)
+                               n = len;
+                       memset(buf, 0, n);
                }
                buf += blocksize - skipfirst;
        }