Messages in this thread | | | Date | Mon, 28 Mar 2022 09:12:27 -0700 | Subject | Re: [PATCH v2] ext4: check if offset+length is valid in fallocate | From | Tadeusz Struk <> |
| |
On 3/15/22 14:54, Tadeusz Struk wrote: > Syzbot found an issue [1] in ext4_fallocate(). > The C reproducer [2] calls fallocate(), passing size 0xffeffeff000ul, > and offset 0x1000000ul, which, when added together exceed the disk size, > and trigger a BUG in ext4_ind_remove_space() [3]. > According to the comment doc in ext4_ind_remove_space() the 'end' block > parameter needs to be one block after the last block to remove. > In the case when the BUG is triggered it points to the last block on > a 4GB virtual disk image. This is calculated in > ext4_ind_remove_space() in [4]. > This patch adds a check that ensure the length + offest to be > within the valid range and returns -ENOSPC error code in case > it is invalid.
Hi, Any feedback on this?
-- Thanks, Tadeusz
| |