Validate e_value_offs for in-inode EAs
PATCH 1/1 Validate e_value_offs for in-inode EAs
Hi Ted,
We came across a corruption in which e_value_offs for an in-inode EA was corrupt and the overflow was causing a segfault. We should validate e_value_offs for in-inode EAs as well.
I have also attached the regression test for this problem.
Signed-off-by Girish Shilamkar <[email protected]>
Signature · 2 lines
Thanks, Girish
e2fsck/pass1.c +7 -0
@@ -318,6 +318,13 @@ goto fix; } +/* Value size cannot be larger than EA space in inode */ +if (entry->e_value_offs > storage_size || + entry->e_value_offs + entry->e_value_size > storage_size) { + problem =PR_1_INODE_EA_BAD_VALUE ; + goto fix; + } + hash =ext2fs_ext_attr_hash_entry (entry, start + entry->e_value_offs);
e2fsck/problem.c +5 -0
@@ -908,6 +908,11 @@N_ ("Pass 1C: Scanning directories for @is with @m @bs\n" ), PROMPT_NONE, 0 }, +/* Bad extended attribute value in inode */ + { PR_1_INODE_EA_BAD_VALUE, +N_ ("@a in @i %i is corrupt (@n value)." ), + PROMPT_CLEAR, 0}, +/* Pass 1D: Reconciling multiply-claimed blocks */ { PR_1D_PASS_HEADER,
e2fsck/problem.h +3 -0
@@ -560,6 +560,9 @@/* Couldn't clone file (error) */ #define PR_1D_CLONE_ERROR 0x013008 +/* Bad extended attribute value in inode */ +#define PR_1_INODE_EA_BAD_VALUE 0x01006D +/* * Pass 2 errors */
tests/f_bad_ea_value/expect.1 new file +11 -0
@@ -0,0 +1,11 @@ +Pass 1: Checking inodes, blocks, and sizes +Extended attribute in inode 13 is corrupt (invalid value).Clear? yes + +Pass 2: Checking directory structure +Pass 3: Checking directory connectivity +Pass 4: Checking reference counts +Pass 5: Checking group summary information + +test_filesys: ***** FILE SYSTEM WAS MODIFIED ***** +test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks +Exit status is 1
tests/f_bad_ea_value/expect.2 new file +7 -0
@@ -0,0 +1,7 @@ +Pass 1: Checking inodes, blocks, and sizes +Pass 2: Checking directory structure +Pass 3: Checking directory connectivity +Pass 4: Checking reference counts +Pass 5: Checking group summary information +test_filesys: 13/2048 files (0.0% non-contiguous), 1293/2048 blocks +Exit status is 0
tests/f_bad_ea_value/name new file +1 -0
@@ -0,0 +1 @@ +invalid value of in-inode EA offset
tests/f_bad_ea_value/image.gz new file +4 -0
@@ -0,0 +1,4 @@ +��H�Iimage ��|u���$� �`��,�A@������ $�ޱ��{���{k���r���}�;'���;��d�? 3����`��bRCr6�,5���ɕ�6�,�i���7�5�wI�\%�>*-)͇'^�����)��%[M�+N�M��q�_����;���>ԧ�7��k��S~���~<}��M��n�m�J�1o�ܷ���*�N3�S��6͔fN��Y�li��)���?]��0 �"���M'��Oh^6q + �+�qj7�4~� �`��� ��5no�cl�Ƽ*b��A����4�U��4����;��wz#� ����9����K�����~�uF�J��q�����,�� �����~�����e%?��_�,�ϧK�S���w��?�3w�t�Eƽ��zmm�1�6��y�63u�q��П����������n��ƿ��f����h��ʪ����wS||�y$ �3���%�e�>]V�1Zez֒�e#���wR�P[]�W�IiU��2}w�&�C��<� 0�k5���gm&m� 1m= `� �� ��Ư�ܱ9k:�R�����엖9n���]��~�ܾ�'��t�f� �Կ�_܆/��ɯ,�8�����K��-=� 0u�q�i�� �4��I�����Mh^��V ����9�VR�a����4����嚕��L�����?�5�3w�t�Eƽ�I��y�1�6��y�6O�_�q�NU�������_�n��Q����WV ��0<����[�#0m�������N�����5���������(��� �X���������?[��OL?�:��O��_|�'ۀ��ն���Zf�Z��i�4cj�ڦ���i�4k�-�n��'_�ߺ����ߧ��:�B�L�ZҲlDݘ�C�j���5)��]2C��nӤtH]� �r���_69 �_|�F�0��~e�����`��K��? ��9�ߴ����Q�/C�8�_���:���k��_�������`�6�������� �����L�?�lB�2�� �_��%%s����i�4o�/�-͟ +i��.-�J�EҢi��xj�:�%Ry�:�Ω"uIK����i��5-��K˧Ҋi��rZ%uK�Ӫi��#�L��^i��;�����i��/�O��i`��I����i��a�(m�6I�����i�T����T�jҐ44 K�Ӗi�4"�L��._ٸu�Ƥ�Ԑ�Iۦ���i��c�)�vI�����i��g�+��I����ش: �J�Cҡ�tx:"��JG�cұ�t|:!��NJ'�Sҩ�tz:#���Jg�sҹ�t~� ]�.J�Kҥ�ty�"]��JW�kҵ�4.]�nH7����i|�%ݚnK��;ҝ�tw�'ݛ�K��҃��pz$=�K��'ғ��tz&=��Kϧҋ��rz%��^K��7қ��vz'���K�҇��q�$}�&������e�*}��Iߦ�������#n����$5-�#M���i��2�J��i��&�M3���,i�4[�=͑�Ls���<i�4_�[�?��]Z0-�N��E�bi��>uHK���1uJ�SE꒖LK���2�kZ6-��O+��Ji�Jꖺ�U�j�G�VO���wZ3�I}�Z�_�����4(���M���iôQ�8m�6M�����2U���:դ!ih���-�ViD�jS]��N�ӘT��6i۴]�>�vL;���.i״[�=��L{���>iߴ_��O��A��tH:4�OG�#�Q��tL:6��O'��I��tJ:5��NOg�3�Y��tN:7���O��E��tI�4]�.OW�+�U��tM�6]�ƥ�� ��tS�9�O��[�m��tG�3ݕ�N��{�}���@z0=�N��G�c���Dz2=��NϤg�s���Bz1��^N��W�k���Fz3���N�w�{���A�0}�>N��Oˊ����>O_�/�W���M�6}��O?�����,5IMS�4]j�Z��S��*�N3�S��6͔fN��Y�li�4G�3͕�N�y�|�oi�TH�vi��PZ8-�M���S��!-��S��)uN�KZ2-��Nˤ�iٴ\Z>��VL+���*�[�VM���gZ=�Jk��i��'�Mk�~���NӠ�NZ7���O� �Fi�I�4m�6O[��T���T����iX��L[�id�MuiT�:�NcR}jHۤm�vi��C�1�vN��]�ni��G�3��N��}�~il�?�L���!��tX:<��LG���1��t\:>��NL'���)��tZ:=���Lg���9��t^:?]�.L���%��tY�<]��LW���5��t]��O7��M��4>ݒnM������tW�;ݓ�M�������Pz8=�M�������Tz:=��Mϥ�����Rz9��^M�������Vz;���M������Q�8}�>M�g���E�2}��Nߤo�w���C�q�s��,5IMS�4]j�Z��S��*�N3�S��6͔fN��Y�li�4G�3͕�N�y�|�oi�TH�vi��PZ8-�M���S��!-��S��)uN�KZ2-��Nˤ�iٴ\Z>��VL+���*�[�VM���gZ=�Jk��i��'�Mk�~���NӠ�NZ7���O� �Fi�I�4m�6O[��T���T����iX��L[�id�MuiT�:�NcR}jHۤm�vi��C�1�vN��]�ni��G�3��N��}�~il�?�L���!��tX:<��LG���1��t\:>��NL'���)��tZ:=���Lg���9��t^:?]�.L���%��tY�<]��LW���5��t]��O7��M��4>ݒnM������tW�;ݓ�M�������Pz8=�M�������Tz:=��Mϥ�����Rz9��^M�������Vz;���M������Q�8}�>M�g���E�2}��Nߤo�w���C���t|������$5M��t�yj��O-S�f��= e�͖����3�r�)�6-=t��yq;�8�{� �-������u�����K�B�}atM��1���W5��Tj�kF��z�[�0��j�������Ԏ��8�:�4���2���г����k��=��ӳЮ�k�� �5�]:w^�]��_Xn�����/�v\��cE*//ި.�L��7�ÿ�Q�4�V��ԾP]W�h}aH��5����Bè����¨����j�tZmXe�К�uCs+~������ ��W�niN��P9Ӕs��:c�t��ʪ��3 �[��e*t]���0�R�Ph_]S=|L���U �5Յ���х�a5�^��-h�1|p����5�cj:N��N9Ϳ�k���)�������y����,���Z�fCmMy�Ν�mײ��[���A���ˢ���X���ˋ7�K!������oT�1 ��%;�/T��.Z_R7zhM}����0�����0��~�1�VVY;��o��� +�p �� ���6 �U� k} �