lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 102/128] ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
    Date
    From: Harshad Shirwadkar <harshadshirwadkar@gmail.com>

    commit c36a71b4e35ab35340facdd6964a00956b9fef0a upstream.

    If eh->eh_max is 0, EXT_MAX_EXTENT/INDEX would evaluate to unsigned
    (-1) resulting in illegal memory accesses. Although there is no
    consistent repro, we see that generic/019 sometimes crashes because of
    this bug.

    Ran gce-xfstests smoke and verified that there were no regressions.

    Signed-off-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
    Link: https://lore.kernel.org/r/20200421023959.20879-2-harshadshirwadkar@gmail.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/ext4/ext4_extents.h | 9 ++++++---
    1 file changed, 6 insertions(+), 3 deletions(-)

    --- a/fs/ext4/ext4_extents.h
    +++ b/fs/ext4/ext4_extents.h
    @@ -169,10 +169,13 @@ struct ext4_ext_path {
    (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
    #define EXT_LAST_INDEX(__hdr__) \
    (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
    -#define EXT_MAX_EXTENT(__hdr__) \
    - (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
    +#define EXT_MAX_EXTENT(__hdr__) \
    + ((le16_to_cpu((__hdr__)->eh_max)) ? \
    + ((EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) \
    + : 0)
    #define EXT_MAX_INDEX(__hdr__) \
    - (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
    + ((le16_to_cpu((__hdr__)->eh_max)) ? \
    + ((EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) : 0)

    static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode)
    {

    \
     
     \ /
      Last update: 2020-06-19 18:44    [W:4.466 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site