|
 |
a9c310 |
From aa011a6deafa48b1015d402d7ec0bd40f9308109 Mon Sep 17 00:00:00 2001
|
|
|
a9c310 |
From: Wang Shilong <wshilong@ddn.com>
|
|
|
a9c310 |
Date: Mon, 30 Dec 2019 19:52:39 -0500
|
|
|
a9c310 |
Subject: [PATCH 09/10] e2fsck: fix use after free in calculate_tree()
|
|
|
a9c310 |
|
|
|
a9c310 |
The problem is alloc_blocks() will call get_next_block() which might
|
|
|
a9c310 |
reallocate outdir->buf, and memory address could be changed after
|
|
|
a9c310 |
this. To fix this, pointers that point into outdir->buf, such as
|
|
|
a9c310 |
int_limit and root need to be recaulated based on the new starting
|
|
|
a9c310 |
address of outdir->buf.
|
|
|
a9c310 |
|
|
|
a9c310 |
[ Changed to correctly recalculate int_limit, and to optimize how we
|
|
|
a9c310 |
reallocate outdir->buf. -TYT ]
|
|
|
a9c310 |
|
|
|
a9c310 |
Signed-off-by: Wang Shilong <wshilong@ddn.com>
|
|
|
a9c310 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
a9c310 |
---
|
|
|
a9c310 |
e2fsck/rehash.c | 17 ++++++++++++++++-
|
|
|
a9c310 |
1 file changed, 16 insertions(+), 1 deletion(-)
|
|
|
a9c310 |
|
|
|
a9c310 |
diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
|
|
|
a9c310 |
index 2c908be0..e0764d0b 100644
|
|
|
a9c310 |
--- a/e2fsck/rehash.c
|
|
|
a9c310 |
+++ b/e2fsck/rehash.c
|
|
|
a9c310 |
@@ -297,7 +297,11 @@ static errcode_t get_next_block(ext2_filsys fs, struct out_dir *outdir,
|
|
|
a9c310 |
errcode_t retval;
|
|
|
a9c310 |
|
|
|
a9c310 |
if (outdir->num >= outdir->max) {
|
|
|
a9c310 |
- retval = alloc_size_dir(fs, outdir, outdir->max + 50);
|
|
|
a9c310 |
+ int increment = outdir->max / 10;
|
|
|
a9c310 |
+
|
|
|
a9c310 |
+ if (increment < 50)
|
|
|
a9c310 |
+ increment = 50;
|
|
|
a9c310 |
+ retval = alloc_size_dir(fs, outdir, outdir->max + increment);
|
|
|
a9c310 |
if (retval)
|
|
|
a9c310 |
return retval;
|
|
|
a9c310 |
}
|
|
|
a9c310 |
@@ -641,6 +645,9 @@ static int alloc_blocks(ext2_filsys fs,
|
|
|
a9c310 |
if (retval)
|
|
|
a9c310 |
return retval;
|
|
|
a9c310 |
|
|
|
a9c310 |
+ /* outdir->buf might be reallocated */
|
|
|
a9c310 |
+ *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
|
|
|
a9c310 |
+
|
|
|
a9c310 |
*next_ent = set_int_node(fs, block_start);
|
|
|
a9c310 |
*limit = (struct ext2_dx_countlimit *)(*next_ent);
|
|
|
a9c310 |
if (next_offset)
|
|
|
a9c310 |
@@ -730,6 +737,9 @@ static errcode_t calculate_tree(ext2_filsys fs,
|
|
|
a9c310 |
return retval;
|
|
|
a9c310 |
}
|
|
|
a9c310 |
if (c3 == 0) {
|
|
|
a9c310 |
+ int delta1 = (char *)int_limit - outdir->buf;
|
|
|
a9c310 |
+ int delta2 = (char *)root - outdir->buf;
|
|
|
a9c310 |
+
|
|
|
a9c310 |
retval = alloc_blocks(fs, &limit, &int_ent,
|
|
|
a9c310 |
&dx_ent, &int_offset,
|
|
|
a9c310 |
NULL, outdir, i, &c2,
|
|
|
a9c310 |
@@ -737,6 +747,11 @@ static errcode_t calculate_tree(ext2_filsys fs,
|
|
|
a9c310 |
if (retval)
|
|
|
a9c310 |
return retval;
|
|
|
a9c310 |
|
|
|
a9c310 |
+ /* outdir->buf might be reallocated */
|
|
|
a9c310 |
+ int_limit = (struct ext2_dx_countlimit *)
|
|
|
a9c310 |
+ (outdir->buf + delta1);
|
|
|
a9c310 |
+ root = (struct ext2_dx_entry *)
|
|
|
a9c310 |
+ (outdir->buf + delta2);
|
|
|
a9c310 |
}
|
|
|
a9c310 |
dx_ent->block = ext2fs_cpu_to_le32(i);
|
|
|
a9c310 |
if (c3 != limit->limit)
|
|
|
a9c310 |
--
|
|
|
a9c310 |
2.21.1
|
|
|
a9c310 |
|