diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2023-04-29 16:14:46 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-17 11:11:51 +0200 |
| commit | d5bf8f7fb3ee3d99d1303ceb54599ea0599a4a5b (patch) | |
| tree | 7ce92cf297fde5c1d1a49bca8cc3a6cf2fae4956 /fs | |
| parent | 0fc1041a98be9b1f2eb040554e4d379951a29ad9 (diff) | |
| download | linux-stable-d5bf8f7fb3ee3d99d1303ceb54599ea0599a4a5b.tar.gz linux-stable-d5bf8f7fb3ee3d99d1303ceb54599ea0599a4a5b.tar.bz2 linux-stable-d5bf8f7fb3ee3d99d1303ceb54599ea0599a4a5b.zip | |
ext4: remove a BUG_ON in ext4_mb_release_group_pa()
commit 463808f237cf73e98a1a45ff7460c2406a150a0b upstream.
If a malicious fuzzer overwrites the ext4 superblock while it is
mounted such that the s_first_data_block is set to a very large
number, the calculation of the block group can underflow, and trigger
a BUG_ON check. Change this to be an ext4_warning so that we don't
crash the kernel.
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230430154311.579720-3-tytso@mit.edu
Reported-by: syzbot+e2efa3efc15a1c9e95c3@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/mballoc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index a93bd342e0ae..d9f2fde2e3e9 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3921,7 +3921,11 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b, trace_ext4_mb_release_group_pa(sb, pa); BUG_ON(pa->pa_deleted == 0); ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit); - BUG_ON(group != e4b->bd_group && pa->pa_len != 0); + if (unlikely(group != e4b->bd_group && pa->pa_len != 0)) { + ext4_warning(sb, "bad group: expected %u, group %u, pa_start %llu", + e4b->bd_group, group, pa->pa_pstart); + return 0; + } mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len); atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded); trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len); |