From 80eb68d23897126e7f25e2b3689bc27fb8cdde17 Mon Sep 17 00:00:00 2001 From: Lepton Wu Date: Tue, 16 Oct 2007 23:29:50 -0700 Subject: reiserfs: fix kernel panic on corrupted directory When reading corrupted reiserfs directory data, d_reclen could be a negative number or a big positive number, this can lead to kernel panic or oop. The following patch adds a sanity check. Signed-off-by: Lepton Wu Cc: Chris Mason Cc: Jeff Mahoney Cc: "Vladimir V. Saveliev" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/reiserfs/dir.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c index ffbfc2caaf20..e6b03d2020c1 100644 --- a/fs/reiserfs/dir.c +++ b/fs/reiserfs/dir.c @@ -121,6 +121,16 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir) continue; d_reclen = entry_length(bh, ih, entry_num); d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh); + + if (d_reclen <= 0 || + d_name + d_reclen > bh->b_data + bh->b_size) { + /* There is corrupted data in entry, + * We'd better stop here */ + pathrelse(&path_to_entry); + ret = -EIO; + goto out; + } + if (!d_name[d_reclen - 1]) d_reclen = strlen(d_name); -- cgit v1.2.2