f2fs: be aware of invalid filename length

The filename length in dirent of may become zero-sized after random junk
data injection, once encounter such dirent, find_target_dentry or
f2fs_add_inline_entries will run into an infinite loop. So let f2fs being
aware of that to avoid deadloop.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index e90380d82214f2c90c9f70a5705cfa308b56ffbb..3b1c14e4eeea48b393a6efe38e38e8c9fba42081 100644 (file)
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -101,11 +101,6 @@ static struct f2fs_dir_entry *find_in_block(struct page *dentry_page,
        else
                kunmap(dentry_page);
 
-       /*
-        * For the most part, it should be a bug when name_len is zero.
-        * We stop here for figuring out where the bugs has occurred.
-        */
-       f2fs_bug_on(F2FS_P_SB(dentry_page), d.max < 0);
        return de;
 }
 
@@ -130,6 +125,11 @@ struct f2fs_dir_entry *find_target_dentry(struct fscrypt_name *fname,
 
                de = &d->dentry[bit_pos];
 
+               if (unlikely(!de->name_len)) {
+                       bit_pos++;
+                       continue;
+               }
+
                /* encrypted case */
                de_name.name = d->filename[bit_pos];
                de_name.len = le16_to_cpu(de->name_len);
@@ -147,10 +147,6 @@ struct f2fs_dir_entry *find_target_dentry(struct fscrypt_name *fname,
                        *max_slots = max_len;
                max_len = 0;
 
-               /* remain bug on condition */
-               if (unlikely(!de->name_len))
-                       d->max = -1;
-
                bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
        }
 

diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 772056587eb9aa96f37a428e2ed5faca654f70b4..e61084cac5f19d7823e9259f8e1b9190ee924537 100644 (file)
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -303,11 +303,6 @@ struct f2fs_dir_entry *find_in_inline_dir(struct inode *dir,
        else
                f2fs_put_page(ipage, 0);
 
-       /*
-        * For the most part, it should be a bug when name_len is zero.
-        * We stop here for figuring out where the bugs has occurred.
-        */
-       f2fs_bug_on(sbi, d.max < 0);
        return de;
 }
 
@@ -437,6 +432,12 @@ static int f2fs_add_inline_entries(struct inode *dir,
                }
 
                de = &d.dentry[bit_pos];
+
+               if (unlikely(!de->name_len)) {
+                       bit_pos++;
+                       continue;
+               }
+
                new_name.name = d.filename[bit_pos];
                new_name.len = de->name_len;
 
@@ -448,9 +449,6 @@ static int f2fs_add_inline_entries(struct inode *dir,
                if (err)
                        goto punch_dentry_pages;
 
-               if (unlikely(!de->name_len))
-                       d.max = -1;
-
                bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
        }
        return 0;