ext4: avoid arithemetic overflow that can trigger a BUG
commit bcd8e91f98
upstream.
A maliciously crafted file system can cause an overflow when the
results of a 64-bit calculation is stored into a 32-bit length
parameter.
https://bugzilla.kernel.org/show_bug.cgi?id=200623
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Wen Xu <wen.xu@gatech.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
parent
3f9eafe877
commit
779af00b3f
|
@ -714,6 +714,9 @@ struct fsxattr {
|
|||
/* Max physical block we can address w/o extents */
|
||||
#define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF
|
||||
|
||||
/* Max logical block we can support */
|
||||
#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF
|
||||
|
||||
/*
|
||||
* Structure of an inode on the disk
|
||||
*/
|
||||
|
|
|
@ -3407,11 +3407,16 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
|
|||
{
|
||||
struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
|
||||
unsigned int blkbits = inode->i_blkbits;
|
||||
unsigned long first_block = offset >> blkbits;
|
||||
unsigned long last_block = (offset + length - 1) >> blkbits;
|
||||
unsigned long first_block, last_block;
|
||||
struct ext4_map_blocks map;
|
||||
int ret;
|
||||
|
||||
if ((offset >> blkbits) > EXT4_MAX_LOGICAL_BLOCK)
|
||||
return -EINVAL;
|
||||
first_block = offset >> blkbits;
|
||||
last_block = min_t(loff_t, (offset + length - 1) >> blkbits,
|
||||
EXT4_MAX_LOGICAL_BLOCK);
|
||||
|
||||
if (WARN_ON_ONCE(ext4_has_inline_data(inode)))
|
||||
return -ERANGE;
|
||||
|
||||
|
|
Loading…
Reference in New Issue