[PATCH] ext4: catch integer overflow in ext4_cache_extents

Jan Kara
2020-07-13T12:58:26Z

From: Wolfgang Frisch <wolfgang.frisch@suse.com>

When extent tree is corrupted we can hit BUG_ON in
ext4_es_cache_extent(). Check for this and abort caching instead of
crashing the machine.

Signed-off-by: Wolfgang Frisch <wolfgang.frisch@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
---
fs/ext4/extents.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 221f240eae60..e76d00fda104 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -471,6 +471,10 @@ static void ext4_cache_extents(struct inode *inode,
ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
int len = ext4_ext_get_actual_len(ex);

+ /* Corrupted extent tree? Stop caching... */
+ if (lblk + len < lblk || lblk + len > EXT4_MAX_LOGICAL_BLOCK)
+ return;
+
if (prev && (prev != lblk))
ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
EXTENT_STATUS_HOLE);
--
2.16.4