diff options
| author | Jan Kara <jack@suse.cz> | 2025-02-06 12:44:55 +0300 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2025-03-17 18:19:41 +0300 |
| commit | 5f920d5d60839f7cbbb1ed50eac68d8bc0a73a7c (patch) | |
| tree | 6d161c8a44b25da7030a3f9be5a098f5c5586d60 | |
| parent | c8e008b60492cf6fd31ef127aea6d02fd3d314cd (diff) | |
| download | linux-5f920d5d60839f7cbbb1ed50eac68d8bc0a73a7c.tar.xz | |
ext4: verify fast symlink length
Verify fast symlink length stored in inode->i_size matches the string
stored in the inode to avoid surprises from corrupted filesystems.
Reported-by: syzbot+48a99e426f29859818c0@syzkaller.appspotmail.com
Tested-by: syzbot+48a99e426f29859818c0@syzkaller.appspotmail.com
Fixes: bae80473f7b0 ("ext4: use inode_set_cached_link()")
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Link: https://patch.msgid.link/20250206094454.20522-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
| -rw-r--r-- | fs/ext4/inode.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index fc3e1b474e2c..7d965338c7d2 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5029,8 +5029,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, inode->i_op = &ext4_encrypted_symlink_inode_operations; } else if (ext4_inode_is_fast_symlink(inode)) { inode->i_op = &ext4_fast_symlink_inode_operations; - nd_terminate_link(ei->i_data, inode->i_size, - sizeof(ei->i_data) - 1); + if (inode->i_size == 0 || + inode->i_size >= sizeof(ei->i_data) || + strnlen((char *)ei->i_data, inode->i_size + 1) != + inode->i_size) { + ext4_error_inode(inode, function, line, 0, + "invalid fast symlink length %llu", + (unsigned long long)inode->i_size); + ret = -EFSCORRUPTED; + goto bad_inode; + } inode_set_cached_link(inode, (char *)ei->i_data, inode->i_size); } else { |