Commit c36a71b4 authored by Harshad Shirwadkar's avatar Harshad Shirwadkar Committed by Theodore Ts'o
Browse files

ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max 



If eh->eh_max is 0, EXT_MAX_EXTENT/INDEX would evaluate to unsigned
(-1) resulting in illegal memory accesses. Although there is no
consistent repro, we see that generic/019 sometimes crashes because of
this bug.

Ran gce-xfstests smoke and verified that there were no regressions.

Signed-off-by: default avatarHarshad Shirwadkar <harshadshirwadkar@gmail.com>
Link: https://lore.kernel.org/r/20200421023959.20879-2-harshadshirwadkar@gmail.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
parent 39c0ae16

fs/ext4/ext4_extents.h

+6 −3
Original line number Diff line number Diff line
@@ -171,9 +171,12 @@ struct partial_cluster { 
#define EXT_LAST_INDEX(__hdr__) \

	(EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)

#define EXT_MAX_EXTENT(__hdr__)	\

	(EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)

	((le16_to_cpu((__hdr__)->eh_max)) ? \

	((EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) \

					: 0)

#define EXT_MAX_INDEX(__hdr__) \

	(EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)

	((le16_to_cpu((__hdr__)->eh_max)) ? \

	((EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) : 0)



static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode)

{