1. 26 Feb, 2019 14 commits
  2. 21 Feb, 2019 3 commits
  3. 20 Feb, 2019 2 commits
  4. 19 Feb, 2019 20 commits
  5. 14 Feb, 2019 1 commit
    • Gao Xiang's avatar
      staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() · 419d6efc
      Gao Xiang authored
      As Al pointed out, "
      ... and while we are at it, what happens to
      	unsigned int nameoff = le16_to_cpu(de[mid].nameoff);
      	unsigned int matched = min(startprfx, endprfx);
      
      	struct qstr dname = QSTR_INIT(data + nameoff,
      		unlikely(mid >= ndirents - 1) ?
      			maxsize - nameoff :
      			le16_to_cpu(de[mid + 1].nameoff) - nameoff);
      
      	/* string comparison without already matched prefix */
      	int ret = dirnamecmp(name, &dname, &matched);
      if le16_to_cpu(de[...].nameoff) is not monotonically increasing?  I.e.
      what's to prevent e.g. (unsigned)-1 ending up in dname.len?
      
      Corrupted fs image shouldn't oops the kernel.. "
      
      Revisit the related lookup flow to address the issue.
      
      Fixes: d72d1ce6 ("staging: erofs: add namei functions")
      Cc: <stable@vger.kernel.org> # 4.19+
      Suggested-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      419d6efc