ext4: verify the depth of extent tree in ext4_find_extent()
commit bc890a60247171294acc0bd67d211fa4b88d40ba upstream. If there is a corupted file system where the claimed depth of the extent tree is -1, this can cause a massive buffer overrun leading to sadness. This addresses CVE-2018-10877. https://bugzilla.kernel.org/show_bug.cgi?id=199417 Signed-off-by: Theodore Ts'o <tytso@mit.edu> [bwh: Backported to 3.16: return -EIO instead of -EFSCORRUPTED] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
514f175cbc
commit
c3cccec63f
|
@ -103,6 +103,7 @@ struct ext4_extent_header {
|
|||
};
|
||||
|
||||
#define EXT4_EXT_MAGIC cpu_to_le16(0xf30a)
|
||||
#define EXT4_MAX_EXTENT_DEPTH 5
|
||||
|
||||
#define EXT4_EXTENT_TAIL_OFFSET(hdr) \
|
||||
(sizeof(struct ext4_extent_header) + \
|
||||
|
|
|
@ -795,6 +795,12 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block,
|
|||
|
||||
eh = ext_inode_hdr(inode);
|
||||
depth = ext_depth(inode);
|
||||
if (depth < 0 || depth > EXT4_MAX_EXTENT_DEPTH) {
|
||||
EXT4_ERROR_INODE(inode, "inode has invalid extent depth: %d",
|
||||
depth);
|
||||
ret = -EIO;
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* account possible depth increase */
|
||||
if (!path) {
|
||||
|
|
Loading…
Reference in New Issue