Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef16d8a1 authored by Theodore Ts'o's avatar Theodore Ts'o Committed by Greg Kroah-Hartman
Browse files

ext4: remove a BUG_ON in ext4_mb_release_group_pa() 

commit 463808f237cf73e98a1a45ff7460c2406a150a0b upstream.

If a malicious fuzzer overwrites the ext4 superblock while it is
mounted such that the s_first_data_block is set to a very large
number, the calculation of the block group can underflow, and trigger
a BUG_ON check.  Change this to be an ext4_warning so that we don't
crash the kernel.

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230430154311.579720-3-tytso@mit.edu


Reported-by: default avatar <syzbot+e2efa3efc15a1c9e95c3@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?id=69b28112e098b070f639efb356393af3ffec4220


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c012309a

fs/ext4/mballoc.c

+5 −1
Original line number Diff line number Diff line
@@ -3893,7 +3893,11 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b, 
	trace_ext4_mb_release_group_pa(sb, pa);

	BUG_ON(pa->pa_deleted == 0);

	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);

	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);

	if (unlikely(group != e4b->bd_group && pa->pa_len != 0)) {

		ext4_warning(sb, "bad group: expected %u, group %u, pa_start %llu",

			     e4b->bd_group, group, pa->pa_pstart);

		return 0;

	}

	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);

	atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);

	trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);