diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2019-11-07 21:43:41 -0500 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2019-11-19 12:24:55 -0500 |
| commit | 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a (patch) | |
| tree | f8c0a5dedc0cf0cfe1671e665cc7a65fdde13a05 /fs/ext4/inode.c | |
| parent | 8d0d47ea1640b23678306c007ccc813b5b930af4 (diff) | |
ext4: add more paranoia checking in ext4_expand_extra_isize handling
It's possible to specify a non-zero s_want_extra_isize via debugging
option, and this can cause bad things(tm) to happen when using a file
system with an inode size of 128 bytes.
Add better checking when the file system is mounted, as well as when
we are actually doing the trying to do the inode expansion.
Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu
Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com
Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com
Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Diffstat (limited to 'fs/ext4/inode.c')
| -rw-r--r-- | fs/ext4/inode.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 381813205f99..c6e3fe287b50 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5569,8 +5569,23 @@ static int __ext4_expand_extra_isize(struct inode *inode, { struct ext4_inode *raw_inode; struct ext4_xattr_ibody_header *header; + unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb); + struct ext4_inode_info *ei = EXT4_I(inode); int error; + /* this was checked at iget time, but double check for good measure */ + if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) || + (ei->i_extra_isize & 3)) { + EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)", + ei->i_extra_isize, + EXT4_INODE_SIZE(inode->i_sb)); + return -EFSCORRUPTED; + } + if ((new_extra_isize < ei->i_extra_isize) || + (new_extra_isize < 4) || + (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE)) + return -EINVAL; /* Should never happen */ + raw_inode = ext4_raw_inode(iloc); header = IHDR(inode, raw_inode); |