function simplefs_create() miss check whether eblock->nr_files bigger than SIMPLEFS_MAX_SUBFILES
so when eblock->nr_files is large, eblock->extents[ei].ee_start will cause array out of bounds problem
static int simplefs_create(struct inode* dir,
struct dentry* dentry,
umode_t mode,
bool excl)
{
ci_dir = SIMPLEFS_INODE(dir);
sb = dir->i_sb;
bh = sb_bread(sb, ci_dir->ei_block);
eblock = (struct simplefs_file_ei_block*)bh->b_data;
if (eblock->nr_files == SIMPLEFS_MAX_SUBFILES) { //nr_files may be very large
ret = -EMLINK;
goto end;
}
...;
ei = eblock->nr_files / SIMPLEFS_FILES_PER_EXT; //ei may be very large
bi = eblock->nr_files % SIMPLEFS_FILES_PER_EXT / SIMPLEFS_FILES_PER_BLOCK;
fi = eblock->nr_files % SIMPLEFS_FILES_PER_BLOCK;
if (!eblock->extents[ei].ee_start) { //out of bound read
...;
}
...;
}
To get a PoC, change function write_data_blocks() in mkfs.c like that,
nr_files of root dir will be very large
function simplefs_create() miss check whether eblock->nr_files bigger than SIMPLEFS_MAX_SUBFILES so when eblock->nr_files is large,
eblock->extents[ei].ee_start
will cause array out of bounds problemTo get a PoC, change function write_data_blocks() in mkfs.c like that, nr_files of root dir will be very large
mount this disk image created by![image](https://user-images.githubusercontent.com/42932041/169552767-333c82d7-21e5-480a-94b4-14c7ec16b9d0.png)
mkfs.simplefs
and then try to create file in root dir, you will get a crash