diff options
| author | Andreas Gruenbacher <agruenba@redhat.com> | 2023-03-28 00:43:16 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-24 17:32:37 +0100 |
| commit | d485903231868b01f961c09eeab48f73179ce937 (patch) | |
| tree | 3595c8f7df13c9e16d6b0559e4e870210648e8c6 | |
| parent | 9c6da3b7f12528cd52c458b33496a098b838fcfc (diff) | |
| download | linux-stable-d485903231868b01f961c09eeab48f73179ce937.tar.gz linux-stable-d485903231868b01f961c09eeab48f73179ce937.tar.bz2 linux-stable-d485903231868b01f961c09eeab48f73179ce937.zip | |
gfs2: Fix inode height consistency check
[ Upstream commit cfcdb5bad34f600aed7613c3c1a5e618111f77b7 ]
The maximum allowed height of an inode's metadata tree depends on the
filesystem block size; it is lower for bigger-block filesystems. When
reading in an inode, make sure that the height doesn't exceed the
maximum allowed height.
Arrays like sd_heightsize are sized to be big enough for any filesystem
block size; they will often be slightly bigger than what's needed for a
specific filesystem.
Reported-by: syzbot+45d4691b1ed3c48eba05@syzkaller.appspotmail.com
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/gfs2/glops.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index d78b61ecc1cd..7762483f5f20 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -393,6 +393,7 @@ static int inode_go_demote_ok(const struct gfs2_glock *gl) static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) { + struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); const struct gfs2_dinode *str = buf; struct timespec64 atime; u16 height, depth; @@ -439,7 +440,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) /* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */ gfs2_set_inode_flags(inode); height = be16_to_cpu(str->di_height); - if (unlikely(height > GFS2_MAX_META_HEIGHT)) + if (unlikely(height > sdp->sd_max_height)) goto corrupt; ip->i_height = (u8)height; |