Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e6e1ef4 authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Theodore Ts'o
Browse files

ext4: reject inodes with negative size 



Don't load an inode with a negative size; this causes integer overflow
problems in the VFS.

[ Added EXT4_ERROR_INODE() to mark file system as corrupted. -TYT]

Fixes: a48380f7 (ext4: rename i_dir_acl to i_size_high)
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
parent 011c88e3

fs/ext4/inode.c

+6 −0
Original line number Diff line number Diff line
@@ -4553,6 +4553,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) 
	struct inode *inode;

	journal_t *journal = EXT4_SB(sb)->s_journal;

	long ret;

	loff_t size;

	int block;

	uid_t i_uid;

	gid_t i_gid;
@@ -4655,6 +4656,11 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) 
		ei->i_file_acl |=

			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;

	inode->i_size = ext4_isize(raw_inode);

	if ((size = i_size_read(inode)) < 0) {

		EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size);

		ret = -EFSCORRUPTED;

		goto bad_inode;

	}

	ei->i_disksize = inode->i_size;

#ifdef CONFIG_QUOTA

	ei->i_reserved_quota = 0;