Received: by 2002:a25:e74b:0:0:0:0:0 with SMTP id e72csp960870ybh; Mon, 13 Jul 2020 05:59:03 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw4zYRObXOsf2r+arXqDUF2onUCb4pVrGvQgucR/EyU7u6SpEj/tB+Af5mxZ6Tdo5mF7RZG X-Received: by 2002:a17:906:430b:: with SMTP id j11mr56044117ejm.270.1594645143639; Mon, 13 Jul 2020 05:59:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1594645143; cv=none; d=google.com; s=arc-20160816; b=cHf/kqWQQdKRcfTo3bGRjyDuP77aUF1PCOFa0ePpezCIf8QBOo01q4a/JOgxTMRyoO RLCV+wUSar18oKnTIlsurDiaqc9hIWwnEgre7E84KpMHUEUK6Z97l7WOB9qJHufgqbkj Tu83BbSrWcice4hB5gTXk1ugvQahS03ETlHnpVtoZFl/z6+mfTIWMVYa4nnCBDC5Vcvy PM6+N9iV42/2HlztIiWVlvWfUcF2Z7QIf1ljmJ+Vkg2b2Vrd1ComfdCpkuMfDuX+lfn5 fC6+c7N4kJEwyXOgvMnxGATye14GQIt04+O+jqmc/PuHH03LHJwufEGio2okJXucDqxv mNvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from; bh=LhKAMb0tEl2ckl7CJc9HgKOujhxdlnCPv9gxYiFWJeU=; b=t6Tp4f5MR+aTDshONpgO5CHOMaN98O9zsKyBSdp31emfvK3tcd61zP1ROC8E8HMn0d HQO9rW+PUzbR0yVVrdK8vFfO4/UdwdX9WsJftg7OB+ei4dpQ2wzOU4rYX42cv+qgJxag ur8axUaccLoP0JbHaS0MFUnUC3ryapvHxq1uA3TCIwcs5nPqV2LIr66kSw/9IeUYxy9a rz4Koffxv2ojaiEnu0pZS4pxeTpPbEHg7exGQxUPeNIjF7dsEmlEE2J2kcs9hrcg9Fvs UpMYFGCFn4B4Z+JZwmtMXb/vDV8baH8AbdjzUqBh+4f3ZvnOC6uPjmBly/XUbAVT37i0 ZBew== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-ext4-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id dj11si9971230edb.279.2020.07.13.05.58.29; Mon, 13 Jul 2020 05:59:03 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-ext4-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729523AbgGMM60 (ORCPT + 99 others); Mon, 13 Jul 2020 08:58:26 -0400 Received: from mx2.suse.de ([195.135.220.15]:42398 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729564AbgGMM60 (ORCPT ); Mon, 13 Jul 2020 08:58:26 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id EC355AC91; Mon, 13 Jul 2020 12:58:26 +0000 (UTC) Received: by quack2.suse.cz (Postfix, from userid 1000) id 9FACE1E12C5; Mon, 13 Jul 2020 14:58:24 +0200 (CEST) From: Jan Kara To: Ted Tso Cc: , Wolfgang Frisch , Jan Kara Subject: [PATCH] ext4: catch integer overflow in ext4_cache_extents Date: Mon, 13 Jul 2020 14:58:18 +0200 Message-Id: <20200713125818.21918-1-jack@suse.cz> X-Mailer: git-send-email 2.16.4 Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Wolfgang Frisch When extent tree is corrupted we can hit BUG_ON in ext4_es_cache_extent(). Check for this and abort caching instead of crashing the machine. Signed-off-by: Wolfgang Frisch Signed-off-by: Jan Kara --- fs/ext4/extents.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 221f240eae60..e76d00fda104 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -471,6 +471,10 @@ static void ext4_cache_extents(struct inode *inode, ext4_lblk_t lblk = le32_to_cpu(ex->ee_block); int len = ext4_ext_get_actual_len(ex); + /* Corrupted extent tree? Stop caching... */ + if (lblk + len < lblk || lblk + len > EXT4_MAX_LOGICAL_BLOCK) + return; + if (prev && (prev != lblk)) ext4_es_cache_extent(inode, prev, lblk - prev, ~0, EXTENT_STATUS_HOLE); -- 2.16.4