2.6.22.6 fix kernel panic on corrupted reiserfs directory

Hi,
When reading corrupted reiserfs directory data, d_reclen could be a negative number or a big positive number, this can lead to kernel panic or oop.
The following patch adds a sanity check. (against 2.6.20.4)

diff -X linux-2.6.22.6-lepton/Documentation/dontdiff -pru linux-2.6.22.6/fs/reiserfs/dir.c linux-2.6.22.6-lepton/fs/reiserfs/dir.c
@@ -121,6 +121,16 @@ static int reiserfs_readdir(struct file 
 					continue;
 				d_reclen = entry_length(bh, ih, entry_num);
 				d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh);
+
+				if (d_reclen <= 0 ||
+				    d_name + d_reclen > bh->b_data + bh->b_size) {
+					/* There is corrupted data in entry,
+					 * We'd better stop here */
+					pathrelse(&path_to_entry);
+					ret = -EIO;
+					goto out;
+				}
+		
 				if (!d_name[d_reclen - 1])
 					d_reclen = strlen(d_name);
 

[snap]

Hi,
When reading corrupted reiserfs directory data, d_reclen could be a negative number or a big positive number, this can lead to kernel panic or oop.
The following patch adds a sanity check. (against 2.6.20.4)

diff -X linux-2.6.22.6-lepton/Documentation/dontdiff -pru linux-2.6.22.6/fs/reiserfs/dir.c linux-2.6.22.6-lepton/fs/reiserfs/dir.c
--- linux-2.6.22.6/fs/reiserfs/dir.c 2007-09-14 17:41:15.000000000 +0800
+++ linux-2.6.22.6-lepton/fs/reiserfs/dir.c 2007-09-14
18:02:10.000000000 +0800
@@ -121,6 +121,16 @@ static int reiserfs_readdir(struct file

                                        continue;
                                d_reclen = entry_length(bh, ih, entry_num);
                                d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh);

+
+ if (d_reclen <= 0 ||
+ d_name + d_reclen > bh->b_data +
bh->b_size) {
+ /* There is corrupted data in entry,
+ * We'd better stop here */

+                                       pathrelse(&path_to_entry);
+                                       ret = -EIO;
+                                       goto out;
+                               }
+
                                if (!d_name[d_reclen - 1])
                                        d_reclen = strlen(d_name);

[/snap]

it is Lepton's patch.
Namesys boys, this patch is OK?
Greg, I neither do find this patch in Linus's tree.

Thanks,
Oliver

The point is, if it's not important enough to go into Linus' tree, than it isn't important enough to be in the -stable tree. So please get this patch upstream to Linus, then we will take it for -stable.

thanks,
-chris

P.S. When forwarding someone else's patch, always include the proper authorship (such as "From: Lepton Wu <[email protected]>" in the first line of the email body) so that information is not lost.