Re: [PATCH] fs/ext2: Rework out-of-bounds read for inline and external extents

[Christian Hesse <list@eworm.de>]

[-- Attachment #1.1: Type: text/plain, Size: 1291 bytes --]

Michael Chang via Grub-devel <grub-devel@gnu.org> on Fri, 2025/02/21 09:06:
> Previously, the number of extent entries was not properly capped based
> on the actual available space. This could lead to insufficient reads for
> external extents, since the computation was based solely on the inline
> extent layout.
> 
> In this patch, when processing the extent header, we determine whether
> the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an
> external extent block. We then clamp the number of entries accordingly
> (using max_inline_ext for inline extents and max_external_ext for
> external extent blocks).
> 
> This change ensures that only the valid number of extent entries is
> processed, preventing out-of-bound reads and potential filesystem
> corruption.
> 
> Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents)
> 
> Signed-off-by: Michael Chang <mchang@suse.com>

Tested and it fixes reading from loopback disk on ext4 for me. Thanks!

Tested-by: Christian Hesse <mail@eworm.de>
-- 
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Best regards             my address:    */=0;b=c[a++];)
putchar(b-1/(/*    Chris            cc -ox -xc - && ./x    */b/42*2-3)*42);}

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 141 bytes --]

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel