Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prevent infinite loop in lfs_traverse
lfs_traverse has no protection against infinite loops. Consider what happens if a directory entry has dir.d.tail == cwd... you end up hanging forever. [Relevant section of code:](https://github.com/ARMmbed/littlefs/blob/195075819e05a9ce8568d3d98363f2a6f19ed436/lfs.c#L2294)

```
int lfs_traverse(lfs_t *lfs, int (*cb)(void*, lfs_block_t), void *data) {
    ...
    lfs_dir_t dir;
    lfs_block_t cwd[2]
    ...
    while (true) {
        ...
        lfs_dir_fetch(lfs, &dir, cwd);
        ...
        cwd[0] = dir.d.tail[0];
        cwd[1] = dir.d.tail[1];
        ...
    }
}
```

This is mostly a theoretical issue - this can only really happen if the on-flash data is already in an invalid state. However, as littlefs is supposed to be failsafe...

Two fixes come to mind:

1. Keep a counter. If you ever traverse >= the total number of blocks, you know that you've hit a loop. (This may take a while... but this isn't supposed to happen unless something has gone wrong _anyway_, and it's still better than just hanging forever.)
2. Use something like the tortose-and-hare algorithm. (Advance the hare, do the callback, exit if done, panic if hare == tortose, advance the hare, do the callback, exit if done, panic if hare == tortose, advance the tortose, panic if hare == tortose. Repeat.) Probably overkill.

This change implements #1.
  • Loading branch information
TheLoneWolfling authored Jan 27, 2019
commit 03ba55c3957d7a6a9352693bb986ed87759a47e4
6 changes: 6 additions & 0 deletions lfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -2259,6 +2259,7 @@ int lfs_traverse(lfs_t *lfs, int (*cb)(void*, lfs_block_t), void *data) {
lfs_entry_t entry;
lfs_block_t cwd[2] = {0, 1};

lfs_block_t dirs = 0;
while (true) {
for (int i = 0; i < 2; i++) {
int err = cb(data, cwd[i]);
Expand Down Expand Up @@ -2297,6 +2298,11 @@ int lfs_traverse(lfs_t *lfs, int (*cb)(void*, lfs_block_t), void *data) {
if (lfs_pairisnull(cwd)) {
break;
}
if (dirs++ >= lfs->cfg->block_count) {
// If we reached here, we have more directory pairs than blocks in the
// filesystem... So something must be horribly wrong
return LFS_ERR_CORRUPT;
}
}

// iterate over any open files
Expand Down