|
 |
c4a49e5 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
c4a49e5 |
From: Lidong Chen <lidong.chen@oracle.com>
|
|
|
c4a49e5 |
Date: Thu, 28 Sep 2023 22:33:44 +0000
|
|
|
c4a49e5 |
Subject: [PATCH] fs/xfs: Incorrect short form directory data boundary check
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
After parsing of the current entry, the entry pointer is advanced
|
|
|
c4a49e5 |
to the next entry at the end of the "for" loop. In case where the
|
|
|
c4a49e5 |
last entry is at the end of the data boundary, the advanced entry
|
|
|
c4a49e5 |
pointer can point off the data boundary. The subsequent boundary
|
|
|
c4a49e5 |
check for the advanced entry pointer can cause a failure.
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
The fix is to include the boundary check into the "for" loop
|
|
|
c4a49e5 |
condition.
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
|
|
|
c4a49e5 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
c4a49e5 |
Tested-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
|
|
|
c4a49e5 |
Tested-by: Marta Lewandowska <mlewando@redhat.com>
|
|
|
c4a49e5 |
---
|
|
|
c4a49e5 |
grub-core/fs/xfs.c | 7 ++-----
|
|
|
c4a49e5 |
1 file changed, 2 insertions(+), 5 deletions(-)
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
|
|
|
c4a49e5 |
index b91cd32b49ab..ebf962793fa7 100644
|
|
|
c4a49e5 |
--- a/grub-core/fs/xfs.c
|
|
|
c4a49e5 |
+++ b/grub-core/fs/xfs.c
|
|
|
c4a49e5 |
@@ -810,7 +810,8 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir,
|
|
|
c4a49e5 |
if (iterate_dir_call_hook (parent, "..", &ctx))
|
|
|
c4a49e5 |
return 1;
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
- for (i = 0; i < head->count; i++)
|
|
|
c4a49e5 |
+ for (i = 0; i < head->count &&
|
|
|
c4a49e5 |
+ (grub_uint8_t *) de < ((grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data)); i++)
|
|
|
c4a49e5 |
{
|
|
|
c4a49e5 |
grub_uint64_t ino;
|
|
|
c4a49e5 |
grub_uint8_t *inopos = grub_xfs_inline_de_inopos(dir->data, de);
|
|
|
c4a49e5 |
@@ -845,10 +846,6 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir,
|
|
|
c4a49e5 |
de->name[de->len] = c;
|
|
|
c4a49e5 |
|
|
|
c4a49e5 |
de = grub_xfs_inline_next_de(dir->data, head, de);
|
|
|
c4a49e5 |
-
|
|
|
c4a49e5 |
- if ((grub_uint8_t *) de >= (grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data))
|
|
|
c4a49e5 |
- return grub_error (GRUB_ERR_BAD_FS, "invalid XFS directory entry");
|
|
|
c4a49e5 |
-
|
|
|
c4a49e5 |
}
|
|
|
c4a49e5 |
break;
|
|
|
c4a49e5 |
}
|