Luís Henriques
be4df018c0
ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 ...
commit 29a5b8a137ac8eb410cc823653a29ac0e7b7e1b0 upstream.
When walking through an inode extents, the ext4_ext_binsearch_idx() function
assumes that the extent header has been previously validated. However, there
are no checks that verify that the number of entries (eh->eh_entries) is
non-zero when depth is > 0. And this will lead to problems because the
EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:
[ 135.245946] ------------[ cut here ]------------
[ 135.247579] kernel BUG at fs/ext4/extents.c:2258!
[ 135.249045] invalid opcode: 0000 [#1 ] PREEMPT SMP
[ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4
[ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
[ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0
[ 135.256475] Code:
[ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246
[ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023
[ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c
[ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c
[ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024
[ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000
[ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0
[ 135.277952] Call Trace:
[ 135.278635] <TASK>
[ 135.279247] ? preempt_count_add+0x6d/0xa0
[ 135.280358] ? percpu_counter_add_batch+0x55/0xb0
[ 135.281612] ? _raw_read_unlock+0x18/0x30
[ 135.282704] ext4_map_blocks+0x294/0x5a0
[ 135.283745] ? xa_load+0x6f/0xa0
[ 135.284562] ext4_mpage_readpages+0x3d6/0x770
[ 135.285646] read_pages+0x67/0x1d0
[ 135.286492] ? folio_add_lru+0x51/0x80
[ 135.287441] page_cache_ra_unbounded+0x124/0x170
[ 135.288510] filemap_get_pages+0x23d/0x5a0
[ 135.289457] ? path_openat+0xa72/0xdd0
[ 135.290332] filemap_read+0xbf/0x300
[ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40
[ 135.292192] new_sync_read+0x103/0x170
[ 135.293014] vfs_read+0x15d/0x180
[ 135.293745] ksys_read+0xa1/0xe0
[ 135.294461] do_syscall_64+0x3c/0x80
[ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0
This patch simply adds an extra check in __ext4_ext_check(), verifying that
eh_entries is not 0 when eh_depth is > 0.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215941
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216283
Cc: Baokun Li <libaokun1@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Luís Henriques <lhenriques@suse.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Link: https://lore.kernel.org/r/20220822094235.2690-1-lhenriques@suse.de
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-28 11:11:57 +02:00
2022-08-17 14:24:07 +02:00
2022-09-23 14:15:51 +02:00
2021-10-20 21:09:02 -04:00
2021-08-19 09:02:55 +09:00
2022-09-28 11:11:42 +02:00
2022-07-02 16:41:14 +02:00
2022-08-25 11:40:13 +02:00
2022-09-23 14:15:48 +02:00
2022-03-02 11:48:02 +01:00
2021-11-18 19:16:11 +01:00
2022-09-15 11:30:02 +02:00
2022-02-01 17:27:01 +01:00
2022-07-29 17:25:24 +02:00
2022-07-02 16:41:14 +02:00
2022-09-15 11:30:06 +02:00
2022-07-29 17:25:30 +02:00
2022-06-09 10:23:32 +02:00
2022-08-17 14:23:00 +02:00
2022-09-28 11:11:57 +02:00
2022-08-25 11:40:45 +02:00
2022-06-09 10:22:42 +02:00
2021-10-04 22:13:12 +01:00
2022-08-17 14:24:11 +02:00
2022-07-12 16:34:59 +02:00
2021-08-26 22:28:02 +02:00
2022-06-09 10:23:11 +02:00
2022-06-09 10:22:55 +02:00
2021-11-12 15:05:50 +01:00
2022-08-17 14:24:01 +02:00
2022-06-14 18:36:10 +02:00
2022-06-09 10:22:41 +02:00
2022-06-14 18:36:22 +02:00
2022-09-05 10:30:11 +02:00
2022-08-17 14:22:47 +02:00
2022-04-13 20:59:10 +02:00
2021-12-29 12:28:59 +01:00
2022-09-28 11:11:57 +02:00
2021-10-04 22:02:17 +01:00
2022-08-17 14:22:45 +02:00
2022-07-21 21:24:14 +02:00
2022-06-09 10:22:50 +02:00
2022-08-03 12:03:41 +02:00
2022-09-05 10:30:10 +02:00
2022-08-03 12:03:41 +02:00
2022-01-20 09:13:13 +01:00
2022-08-25 11:40:43 +02:00
2022-08-31 17:16:37 +02:00
2022-04-08 14:23:01 +02:00
2021-09-21 08:36:48 -07:00
2022-06-22 14:21:56 +02:00
2021-09-03 15:33:47 -07:00
2021-12-14 10:57:12 +01:00
2021-08-16 10:50:32 -06:00
2021-08-06 13:05:28 +02:00
2022-09-20 12:39:43 +02:00
2022-04-08 14:24:08 +02:00
2022-05-15 20:18:52 +02:00
2021-08-19 09:02:55 +09:00
2021-09-27 11:26:21 -07:00
2021-09-22 10:56:34 -07:00
2022-09-28 11:11:45 +02:00
2022-08-31 17:16:34 +02:00
2021-12-14 10:57:22 +01:00
2022-08-17 14:22:50 +02:00
2021-08-18 22:08:24 +02:00
2021-09-05 10:15:05 -07:00
2022-04-08 14:24:17 +02:00
2022-04-08 14:24:18 +02:00
2022-06-09 10:22:26 +02:00
2022-04-08 14:22:54 +02:00
2022-04-08 14:24:18 +02:00
2021-09-02 10:07:29 -07:00
2022-09-28 11:11:56 +02:00
2021-09-03 09:58:10 -07:00
2021-09-06 07:20:56 -04:00
2022-08-17 14:22:59 +02:00
2022-08-17 14:24:19 +02:00
2021-09-03 10:08:28 -07:00
2022-05-18 10:26:57 +02:00
2022-04-08 14:23:54 +02:00
2021-08-23 01:25:40 -04:00
2022-01-20 09:13:14 +01:00
2021-09-07 16:07:47 -04:00
2022-08-31 17:16:47 +02:00
2022-06-14 18:36:26 +02:00
2022-04-27 14:38:50 +02:00
2022-09-05 10:30:06 +02:00
2021-12-22 09:32:51 +01:00
2021-08-29 07:55:55 -06:00
2022-05-25 09:57:26 +02:00
2021-09-12 10:10:21 -07:00
2021-10-18 20:22:03 -10:00
2021-09-07 11:21:48 -07:00
2021-09-12 10:10:21 -07:00
2022-08-17 14:22:57 +02:00
2022-08-17 14:24:19 +02:00
2022-08-31 17:16:37 +02:00
2022-07-02 16:41:17 +02:00
2022-06-06 08:43:37 +02:00
2022-07-02 16:41:17 +02:00
2022-07-02 16:41:14 +02:00
2022-08-03 12:03:41 +02:00
2022-07-21 21:24:14 +02:00
2022-01-29 10:58:25 +01:00
2022-07-12 16:35:08 +02:00
2021-12-14 10:57:15 +01:00
2022-08-17 14:23:31 +02:00
2022-04-27 14:38:57 +02:00
2022-02-23 12:03:05 +01:00
2022-04-27 14:38:50 +02:00
2021-08-10 17:57:22 +02:00
2021-10-18 20:22:02 -10:00
2022-07-02 16:41:17 +02:00
be4df018c0