mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
ext4: verify the depth of extent tree in ext4_find_extent()
commit bc890a6024
upstream.
If there is a corupted file system where the claimed depth of the
extent tree is -1, this can cause a massive buffer overrun leading to
sadness.
This addresses CVE-2018-10877.
https://bugzilla.kernel.org/show_bug.cgi?id=199417
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5ae5732958
commit
87dad44faa
2 changed files with 7 additions and 0 deletions
|
@ -103,6 +103,7 @@ struct ext4_extent_header {
|
|||
};
|
||||
|
||||
#define EXT4_EXT_MAGIC cpu_to_le16(0xf30a)
|
||||
#define EXT4_MAX_EXTENT_DEPTH 5
|
||||
|
||||
#define EXT4_EXTENT_TAIL_OFFSET(hdr) \
|
||||
(sizeof(struct ext4_extent_header) + \
|
||||
|
|
|
@ -881,6 +881,12 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
|
|||
|
||||
eh = ext_inode_hdr(inode);
|
||||
depth = ext_depth(inode);
|
||||
if (depth < 0 || depth > EXT4_MAX_EXTENT_DEPTH) {
|
||||
EXT4_ERROR_INODE(inode, "inode has invalid extent depth: %d",
|
||||
depth);
|
||||
ret = -EFSCORRUPTED;
|
||||
goto err;
|
||||
}
|
||||
|
||||
if (path) {
|
||||
ext4_ext_drop_refs(path);
|
||||
|
|
Loading…
Reference in a new issue