diff options
| author | Jan Kara <jack@suse.cz> | 2019-04-06 18:33:06 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-05-22 07:37:42 +0200 |
| commit | 71478ef67d7c39ba735c07ce3e39eae21ad8681a (patch) | |
| tree | 7423f98bee1944ff321aa8e29acc03fb149a6622 /fs | |
| parent | 001fe0dab4eacd9e714b7c9de5f13af2bb3c3e1a (diff) | |
| download | linux-stable-71478ef67d7c39ba735c07ce3e39eae21ad8681a.tar.gz linux-stable-71478ef67d7c39ba735c07ce3e39eae21ad8681a.tar.bz2 linux-stable-71478ef67d7c39ba735c07ce3e39eae21ad8681a.zip | |
ext4: make sanity check in mballoc more strict
commit 31562b954b60f02acb91b7349dc6432d3f8c3c5f upstream.
The sanity check in mb_find_extent() only checked that returned extent
does not extend past blocksize * 8, however it should not extend past
EXT4_CLUSTERS_PER_GROUP(sb). This can happen when clusters_per_group <
blocksize * 8 and the tail of the bitmap is not properly filled by 1s
which happened e.g. when ancient kernels have grown the filesystem.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/mballoc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index e29fce2fbf25..cc229f3357f7 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1539,7 +1539,7 @@ static int mb_find_extent(struct ext4_buddy *e4b, int block, ex->fe_len += 1 << order; } - if (ex->fe_start + ex->fe_len > (1 << (e4b->bd_blkbits + 3))) { + if (ex->fe_start + ex->fe_len > EXT4_CLUSTERS_PER_GROUP(e4b->bd_sb)) { /* Should never happen! (but apparently sometimes does?!?) */ WARN_ON(1); ext4_error(e4b->bd_sb, "corruption or bug in mb_find_extent " |