summaryrefslogtreecommitdiff
path: root/fs/ext2
diff options
context:
space:
mode:
authorEric Sandeen <sandeen@redhat.com>2007-02-10 01:45:06 -0800
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-02-11 10:51:28 -0800
commitd8adb9cef7e406a9a82881695097c702bc98422f (patch)
tree3a8ac99c4247ebba99da8dafb5ddc77f2cc61f4e /fs/ext2
parent23c887522e912ca494950796a95df8dd210f4b01 (diff)
downloadlinux-3.10-d8adb9cef7e406a9a82881695097c702bc98422f.tar.gz
linux-3.10-d8adb9cef7e406a9a82881695097c702bc98422f.tar.bz2
linux-3.10-d8adb9cef7e406a9a82881695097c702bc98422f.zip
[PATCH] ext2: skip pages past number of blocks in ext2_find_entry
This one was pointed out on the MOKB site: http://kernelfun.blogspot.com/2006/11/mokb-09-11-2006-linux-26x-ext2checkpage.html If a directory's i_size is corrupted, ext2_find_entry() will keep processing pages until the i_size is reached, even if there are no more blocks associated with the directory inode. This patch puts in some minimal sanity-checking so that we don't keep checking pages (and issuing errors) if we know there can be no more data to read, based on the block count of the directory inode. This is somewhat similar in approach to the ext3 patch I sent earlier this year. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/ext2')
-rw-r--r--fs/ext2/dir.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
index 0b02ba9642d..e89bfc8cf95 100644
--- a/fs/ext2/dir.c
+++ b/fs/ext2/dir.c
@@ -368,6 +368,14 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode * dir,
}
if (++n >= npages)
n = 0;
+ /* next page is past the blocks we've got */
+ if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) {
+ ext2_error(dir->i_sb, __FUNCTION__,
+ "dir %lu size %lld exceeds block count %llu",
+ dir->i_ino, dir->i_size,
+ (unsigned long long)dir->i_blocks);
+ goto out;
+ }
} while (n != start);
out:
return NULL;