Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1462424
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.6 51/56] ext4: check for extents that wrap around |
| Date | 2016-08-14 22:50 +0200 |
| Message-ID | <s6aw2-4AX-55@gated-at.bofh.it> (permalink) |
| References | <s6amm-4wI-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit f70749ca42943faa4d4dcce46dfdcaadb1d0c4b6 upstream.
An extent with lblock = 4294967295 and len = 1 will pass the
ext4_valid_extent() test:
ext4_lblk_t last = lblock + len - 1;
if (len == 0 || lblock > last)
return 0;
since last = 4294967295 + 1 - 1 = 4294967295. This would later trigger
the BUG_ON(es->es_lblk + es->es_len < es->es_lblk) in ext4_es_end().
We can simplify it by removing the - 1 altogether and changing the test
to use lblock + len <= lblock, since now if len = 0, then lblock + 0 ==
lblock and it fails, and if len > 0 then lblock + len > lblock in order
to pass (i.e. it doesn't overflow).
Fixes: 5946d0893 ("ext4: check for overlapping extents in ext4_valid_extent_entries()")
Fixes: 2f974865f ("ext4: check for zero length extent explicitly")
Cc: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -376,9 +376,13 @@ static int ext4_valid_extent(struct inod
ext4_fsblk_t block = ext4_ext_pblock(ext);
int len = ext4_ext_get_actual_len(ext);
ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
- ext4_lblk_t last = lblock + len - 1;
- if (len == 0 || lblock > last)
+ /*
+ * We allow neither:
+ * - zero length
+ * - overflow/wrap-around
+ */
+ if (lblock + len <= lblock)
return 0;
return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.6 00/56] 4.6.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:40 +0200 [PATCH 4.6 56/56] ext4: fix reference counting bug on block allocation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 02/56] libnvdimm, pfn, dax: fix initialization vs autodetect for mode + alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 28/56] x86/xen, pat: Remove PAT table init code from Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 35/56] mm: memcontrol: fix memcg id ref counter on swap charge move Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 06/56] bonding: set carrier off for devices created through netlink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 34/56] mm: memcontrol: fix swap counter leak on swapout from offline cgroup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 32/56] powerpc/eeh: Fix invalid cached PE primary bus Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 39/56] radix-tree: account nodes to memcg only if explicitly requested Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 45/56] Revert "mm, mempool: only set __GFP_NOMEMALLOC if there are free elements" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 41/56] x86/power/64: Fix hibernation return address corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 22/56] random: strengthen input validation for RNDADDTOENTCNT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 54/56] ext4: validate s_reserved_gdt_blocks on mount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 37/56] block: fix use-after-free in seq file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 51/56] ext4: check for extents that wrap around Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 27/56] x86/mtrr: Fix PAT init handling when MTRR is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 05/56] tcp: enable per-socket rate limiting of all challenge acks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 25/56] x86/mm/pat: Replace cpu_has_pat with boot_cpu_has() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 21/56] regulator: qcom_smd: Remove list_voltage callback for rpm_smps_ldo_ops_fixed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 47/56] Revert "cpufreq: pcc-cpufreq: update default value of cpuinfo_transition_latency" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 50/56] serial: mvebu-uart: free the IRQ in ->shutdown() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 53/56] ext4: dont call ext4_should_journal_data() on the journal inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 46/56] fs/dcache.c: avoid soft-lockup in dput() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 48/56] crypto: gcm - Filter out async ghash if necessary Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 09/56] bridge: Fix incorrect re-injection of LLDP packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 30/56] x86/mm/pat: Fix BUG_ON() in mmap_mem() on QEMU/i386 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 38/56] sysv, ipc: fix security-layer leaking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 44/56] fuse: fix wrong assignment of ->flags in fuse_send_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 18/56] IB/hfi1: Correct issues with sc5 computation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 16/56] arm: oabi compat: add missing access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 17/56] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200 [PATCH 4.6 42/56] fuse: fsync() did not return IO errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 36/56] x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 29/56] x86/pat: Document the PAT initialization sequence Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 40/56] x86/microcode: Fix suspend to RAM with builtin microcode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 33/56] powerpc/bpf/jit: Disable classic BPF JIT on ppc64le Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 26/56] x86/mtrr: Fix Xorg crashes in Qemu sessions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 23/56] x86/mm/pat: Add support of non-default PAT MSR setting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 52/56] ext4: fix deadlock during page writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 55/56] ext4: short-cut orphan cleanup on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 31/56] udf: Prevent stack overflow on corrupted filesystem mount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 43/56] fuse: fuse_flush must check mapping->flags for errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 49/56] crypto: scatterwalk - Fix test in scatterwalk_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200 [PATCH 4.6 20/56] apparmor: fix ref count leak when profile sha1 hash is read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 04/56] tcp: make challenge acks less predictable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 03/56] ppp: defer netns reference release for ppp channel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 19/56] IB/hfi1: Fix deadlock with txreq allocation slow path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 08/56] vlan: use a valid default mtu value for vlan over macsec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 07/56] net: bgmac: Fix infinite loop in bgmac_dma_tx_add() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 [PATCH 4.6 24/56] x86/mm/pat: Add pat_disable() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:10 +0200 Re: [PATCH 4.6 00/56] 4.6.7-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-15 15:10 +0200 Re: [PATCH 4.6 00/56] 4.6.7-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-16 06:10 +0200
csiph-web