lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 063/390] ext4: fix check for block being out of directory size
    Date
    From: Jan Kara <jack@suse.cz>

    commit 61a1d87a324ad5e3ed27c6699dfc93218fcf3201 upstream.

    The check in __ext4_read_dirblock() for block being outside of directory
    size was wrong because it compared block number against directory size
    in bytes. Fix it.

    Fixes: 65f8ea4cd57d ("ext4: check if directory block is within i_size")
    CVE: CVE-2022-1184
    CC: stable@vger.kernel.org
    Signed-off-by: Jan Kara <jack@suse.cz>
    Reviewed-by: Lukas Czerner <lczerner@redhat.com>
    Link: https://lore.kernel.org/r/20220822114832.1482-1-jack@suse.cz
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/ext4/namei.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/ext4/namei.c
    +++ b/fs/ext4/namei.c
    @@ -125,7 +125,7 @@ static struct buffer_head *__ext4_read_d
    struct ext4_dir_entry *dirent;
    int is_dx_block = 0;

    - if (block >= inode->i_size) {
    + if (block >= inode->i_size >> inode->i_blkbits) {
    ext4_error_inode(inode, func, line, block,
    "Attempting to read directory block (%u) that is past i_size (%llu)",
    block, inode->i_size);

    \
     
     \ /
      Last update: 2022-10-24 15:06    [W:4.043 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site