Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 4d982e25 authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: avoid divide by zero fault when deleting corrupted inline directories

A specially crafted file system can trick empty_inline_dir() into
reading past the last valid entry in a inline directory, and then run
into the end of xattr marker. This will trigger a divide by zero
fault.  Fix this by using the size of the inline directory instead of
dir->i_size.

Also clean up error reporting in __ext4_check_dir_entry so that the
message is clearer and more understandable --- and avoids the division
by zero trap if the size passed in is zero.  (I'm not sure why we
coded it that way in the first place; printing offset % size is
actually more confusing and less useful.)

https://bugzilla.kernel.org/show_bug.cgi?id=200933



Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reported-by: default avatarWen Xu <wen.xu@gatech.edu>
Cc: stable@vger.kernel.org
parent b50282f3
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment