Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f92f44ea authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Greg Kroah-Hartman
Browse files

gfs2: Fix inode height consistency check 



[ Upstream commit cfcdb5bad34f600aed7613c3c1a5e618111f77b7 ]

The maximum allowed height of an inode's metadata tree depends on the
filesystem block size; it is lower for bigger-block filesystems.  When
reading in an inode, make sure that the height doesn't exceed the
maximum allowed height.

Arrays like sd_heightsize are sized to be big enough for any filesystem
block size; they will often be slightly bigger than what's needed for a
specific filesystem.

Reported-by: default avatar <syzbot+45d4691b1ed3c48eba05@syzkaller.appspotmail.com>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 60c8645a

fs/gfs2/glops.c

+2 −1
Original line number Diff line number Diff line
@@ -339,6 +339,7 @@ static int inode_go_demote_ok(const struct gfs2_glock *gl) 


static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)

{

	struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);

	const struct gfs2_dinode *str = buf;

	struct timespec64 atime;

	u16 height, depth;
@@ -378,7 +379,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) 
	/* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */

	gfs2_set_inode_flags(&ip->i_inode);

	height = be16_to_cpu(str->di_height);

	if (unlikely(height > GFS2_MAX_META_HEIGHT))

	if (unlikely(height > sdp->sd_max_height))

		goto corrupt;

	ip->i_height = (u8)height;