mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
gfs2: Always check inode size of inline inodes
commit70376c7ff3
upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit7db354444a
("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
928240c368
commit
4d4cb76636
3 changed files with 3 additions and 5 deletions
|
@ -456,8 +456,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
|
|||
return error;
|
||||
|
||||
kaddr = kmap_atomic(page);
|
||||
if (dsize > gfs2_max_stuffed_size(ip))
|
||||
dsize = gfs2_max_stuffed_size(ip);
|
||||
memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
|
||||
memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
|
||||
kunmap_atomic(kaddr);
|
||||
|
|
|
@ -70,9 +70,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh,
|
|||
void *kaddr = kmap(page);
|
||||
u64 dsize = i_size_read(inode);
|
||||
|
||||
if (dsize > gfs2_max_stuffed_size(ip))
|
||||
dsize = gfs2_max_stuffed_size(ip);
|
||||
|
||||
memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
|
||||
memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
|
||||
kunmap(page);
|
||||
|
|
|
@ -411,6 +411,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
|
|||
ip->i_depth = (u8)depth;
|
||||
ip->i_entries = be32_to_cpu(str->di_entries);
|
||||
|
||||
if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip))
|
||||
goto corrupt;
|
||||
|
||||
if (S_ISREG(ip->i_inode.i_mode))
|
||||
gfs2_set_aops(&ip->i_inode);
|
||||
|
||||
|
|
Loading…
Reference in a new issue