Eric Biggers 48fcd08b90 fs/minix: reject too-large maximum file size ... commit 270ef41094 upstream. If the minix filesystem tries to map a very large logical block number to its on-disk location, block_to_path() can return offsets that are too large, causing out-of-bounds memory accesses when accessing indirect index blocks. This should be prevented by the check against the maximum file size, but this doesn't work because the maximum file size is read directly from the on-disk superblock and isn't validated itself. Fix this by validating the maximum file size at mount time. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot+c7d9ec7a1a7272dd71b3@syzkaller.appspotmail.com Reported-by: syzbot+3b7b03a0c28948054fb5@syzkaller.appspotmail.com Reported-by: syzbot+6e056ee473568865f3e6@syzkaller.appspotmail.com Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Qiujun Huang <anenbupt@gmail.com> Cc: <stable@vger.kernel.org> Link: http://lkml.kernel.org/r/20200628060846.682158-4-ebiggers@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-08-21 11:02:06 +02:00
..
Kconfig	…
Makefile	…
bitmap.c	fs: Replace CURRENT_TIME_SEC with current_time() for inode timestamps	2016-09-27 21:06:22 -04:00
dir.c	fs: Replace CURRENT_TIME_SEC with current_time() for inode timestamps	2016-09-27 21:06:22 -04:00
file.c	fs: Give dentry to inode_change_ok() instead of inode	2016-09-22 10:56:19 +02:00
inode.c	fs/minix: reject too-large maximum file size	2020-08-21 11:02:06 +02:00
itree_common.c	fs/minix: check return value of sb_getblk()	2020-08-21 11:02:05 +02:00
itree_v1.c	…
itree_v2.c	…
minix.h	…
namei.c	Merge remote-tracking branch 'ovl/rename2' into for-linus	2016-10-10 23:02:51 -04:00