Repository navigation
isofs: advance to the next block when a record ends at the block end - #2662
Closed
vfsci-bot[bot] wants to merge 1 commit into
Closed
vfsci-bot[bot] wants to merge 1 commit into
vfsci-bot[bot] wants to merge 1 commit into
Conversation
Since commit b2eb2e2 ("isofs: Drop support of directory entries straddling blocks") some ISO 9660 images list incomplete directories: find returns fewer entries than before, and some of the names readdir does return cannot be looked up. The log fills with iso9660: Corrupted directory entry in block 0 of inode 55232 and on some images the walk reads a byte past the end of a buffer: BUG: KASAN: use-after-free in isofs_readdir+0x93b/0xc40 Affected are images with a directory record ending exactly at the end of a logical block, which ECMA-119 allows and current tools produce. On the Debian 13.7.0 amd64 DVD-1, which has three, find returns 9163 entries instead of 9461: https://cdimage.debian.org/debian-cd/13.7.0/amd64/iso-dvd/debian-13.7.0-amd64-DVD-1.iso The KASAN report is from a shareware CD with one in its root directory: https://archive.org/download/simtel-1-0295/SIMTEL1_0295.ISO A local one, which lists 46 of its 65 files: mkdir tree for i in $(seq -f '%04g' 1 65); do echo hi > tree/FILE$i.TXT; done xorrisofs -iso-level 1 -o boundary.iso tree/ genisoimage pads the tail of a block instead of filling it exactly, so its images have no such records. That commit removed the reassembly of records crossing a block boundary. Its condition was "offset >= bufsize", so it also handled a record ending exactly at the end (offset == bufsize): drop the buffer, increment the block, reset the offset. Nothing does that now, so do_isofs_readdir() and isofs_find_entry() read the next record's length byte from bh->b_data + bufsize, one past the buffer. Depending on that byte the walk either treats the rest of the block as padding and skips the next block of entries, or fails the record as corrupt and stops. Straddling records stay rejected: isofs_dir_record_valid() fails them because their length exceeds the remaining space, which is what that commit relied on. One ending exactly at the end fits in its block and is accepted, so it is the advance, not the reassembly, that has to come back. Do it at the top of the loop: do_isofs_readdir() reaches the next iteration from the multi-extent branch, "." and "..", the hidden/associated skip (showassoc is off by default, so no mount option is needed) and the fall-through, and all of them need covering. The record was validated to end within the block, so offset never exceeds bufsize. Fixes: b2eb2e2 ("isofs: Drop support of directory entries straddling blocks") Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Author
|
This PR is older than 14 days. Closing automatically. If the series is still relevant, a new version will create a new PR. Automated by ml2pr |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Series: https://patchwork.kernel.org/project/linux-fsdevel/list/?series=1171012
Submitter: Matthias Goergens
Version: 1
Patches: 1/1
Message-ID:
<20260922054853.469681-1-matthias.goergens@gmail.com>Base: vfs.base.ci
Lore: https://lore.kernel.org/linux-fsdevel/20260922054853.469681-1-matthias.goergens@gmail.com
Automated by ml2pr