LKML Archive on
help / color / mirror / Atom feed
* [PATCH] ext2: skip pages past number of blocks in ext2_find_entry (CVE-2006-6054)
@ 2007-01-11  1:27 Chris Wright
  0 siblings, 0 replies; only message in thread
From: Chris Wright @ 2007-01-11  1:27 UTC (permalink / raw)
  To: akpm, torvalds; +Cc: Eric Sandeen, linux-kernel

This one looks like it fell through the cracks, it's in but not upstream yet.

Subject: [PATCH] ext2: skip pages past number of blocks in ext2_find_entry (CVE-2006-6054)
From: Eric Sandeen <>

This one was pointed out on the MOKB site:

If a directory's i_size is corrupted, ext2_find_entry() will keep processing
pages until the i_size is reached, even if there are no more blocks associated
with the directory inode.  This patch puts in some minimal sanity-checking
so that we don't keep checking pages (and issuing errors) if we know there
can be no more data to read, based on the block count of the directory inode.

This is somewhat similar in approach to the ext3 patch I sent earlier this

Signed-off-by: Eric Sandeen <>
Signed-off-by: Chris Wright <>
Not upstream yet

 fs/ext2/dir.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- linux-
+++ linux-
@@ -368,6 +368,14 @@ struct ext2_dir_entry_2 * ext2_find_entr
 		if (++n >= npages)
 			n = 0;
+		/* next page is past the blocks we've got */
+		if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) {
+			ext2_error(dir->i_sb, __FUNCTION__,
+				"dir %lu size %lld exceeds block count %llu",
+				dir->i_ino, dir->i_size,
+				(unsigned long long)dir->i_blocks);
+			goto out;
+		}
 	} while (n != start);
 	return NULL;

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2007-01-11  1:21 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-01-11  1:27 [PATCH] ext2: skip pages past number of blocks in ext2_find_entry (CVE-2006-6054) Chris Wright

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).