Received: by 2002:a25:6193:0:0:0:0:0 with SMTP id v141csp2236282ybb; Mon, 30 Mar 2020 02:11:15 -0700 (PDT) X-Google-Smtp-Source: ADFU+vuTovbyyizPL+SgEwEABkfnJegUcUVBauL+Ara+6WWZb/UfQ9lXxDn4svEC6UUhW1R41PCr X-Received: by 2002:a9d:1423:: with SMTP id h32mr8218511oth.359.1585559475385; Mon, 30 Mar 2020 02:11:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585559475; cv=none; d=google.com; s=arc-20160816; b=gYP4eJ+utJ48KS6uxNHCeA2tGXzP2FoCQb9dte5haPO2rCRQL+/gCC9kK5XyGVXpGv QV4hl/umNkoyrjAaAgod5YeZz9utolnzU3rY9EHYuLmZSwmg//aApfLNds9MLTOVo1Oq 9tebbu4oxWqQ1fnOv/F2vEVvqAgyTRi/ITHyT3pLtldf9b2kaa1EZ3gIzb/gWeNeobQ1 lPXCgQQievahffSZfkDDBIAurd5JaChtl5Yk26EijbEDZWl7IPfu/m/ntDACHSrTGVj2 m07K54oaOX0vTjdgwoH8QgC1kBTbbNMuTpPDwlnv9WEnYBd9d4iuGJJdK6tiSQTVYFWv Xz6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from; bh=JfAjOibvJfEvhBdQ4YTc8/FsWKyrscVRZCfUYYTPZIo=; b=sj8+3tswTvbh9vwFfl0hGmjbFbY4J77Hc0IwD2UFPbFZQX4OxMPqcBBdU5KekglU3l Q8BrXHlnEmJeXr6s4adJp7muD4HlKBznTfWHdcjUlD2XZ+uSj+rO48/DE+1YAYN8Bb/Q 1VyPlry1BFbrJsFZx8IVrPkQOvkgNfRtJ4s13ZFazHAAQVgDC8HjDJSnycxSOtBLNh8h jdz44Eae/OiYtvkZjIPi6kP1/V+OJb0f1RD+ctYDJJ9eI5wpMppJrl3Ulpd18whEJked xPNXssJEbgcEEk9ll1Hd5M8inQLxyD0U/HrVqZKivdQMzvMK18AqbVb8C29/Oq9FeM2o rf3A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-ext4-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-ext4-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m8si5558575oim.26.2020.03.30.02.11.04; Mon, 30 Mar 2020 02:11:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-ext4-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-ext4-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-ext4-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729768AbgC3JJh (ORCPT + 99 others); Mon, 30 Mar 2020 05:09:37 -0400 Received: from mx2.suse.de ([195.135.220.15]:39834 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729684AbgC3JJh (ORCPT ); Mon, 30 Mar 2020 05:09:37 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 88994AD5D; Mon, 30 Mar 2020 09:09:36 +0000 (UTC) Received: by quack2.suse.cz (Postfix, from userid 1000) id 073581E0E44; Mon, 30 Mar 2020 11:09:36 +0200 (CEST) From: Jan Kara To: Ted Tso Cc: , Jan Kara Subject: [PATCH 2/2] ext2fs: Fix off-by-one in dx_grow_tree() Date: Mon, 30 Mar 2020 11:09:32 +0200 Message-Id: <20200330090932.29445-3-jack@suse.cz> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20200330090932.29445-1-jack@suse.cz> References: <20200330090932.29445-1-jack@suse.cz> Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org There is an off-by-one error in dx_grow_tree() when checking whether we can add another level to the tree. Thus we can grow tree too much leading to possible crashes in the library or corrupted filesystem. Fix the bug. Signed-off-by: Jan Kara --- lib/ext2fs/link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ext2fs/link.c b/lib/ext2fs/link.c index 7b5bb022117c..469eea8cd06d 100644 --- a/lib/ext2fs/link.c +++ b/lib/ext2fs/link.c @@ -473,7 +473,7 @@ static errcode_t dx_grow_tree(ext2_filsys fs, ext2_ino_t dir, ext2fs_le16_to_cpu(info->frames[i].head->limit)) break; /* Need to grow tree depth? */ - if (i < 0 && info->levels > ext2_dir_htree_level(fs)) + if (i < 0 && info->levels >= ext2_dir_htree_level(fs)) return EXT2_ET_DIR_NO_SPACE; lblk = size / fs->blocksize; size += fs->blocksize; -- 2.16.4