54 lines
1.9 KiB
Diff
54 lines
1.9 KiB
Diff
From: Theodore Ts'o <tytso@mit.edu>
|
|
Date: Wed, 13 Jun 2018 23:00:48 -0400
|
|
Subject: ext4: always check block group bounds in ext4_init_block_bitmap()
|
|
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit?id=dcf37fefac3f699aa1341f86bcd7808ccc651c33
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-10878
|
|
|
|
Regardless of whether the flex_bg feature is set, we should always
|
|
check to make sure the bits we are setting in the block bitmap are
|
|
within the block group bounds.
|
|
|
|
https://bugzilla.kernel.org/show_bug.cgi?id=199865
|
|
|
|
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
---
|
|
fs/ext4/balloc.c | 10 +++-------
|
|
1 file changed, 3 insertions(+), 7 deletions(-)
|
|
|
|
--- a/fs/ext4/balloc.c
|
|
+++ b/fs/ext4/balloc.c
|
|
@@ -184,7 +184,6 @@ static int ext4_init_block_bitmap(struct
|
|
unsigned int bit, bit_max;
|
|
struct ext4_sb_info *sbi = EXT4_SB(sb);
|
|
ext4_fsblk_t start, tmp;
|
|
- int flex_bg = 0;
|
|
|
|
J_ASSERT_BH(bh, buffer_locked(bh));
|
|
|
|
@@ -207,22 +206,19 @@ static int ext4_init_block_bitmap(struct
|
|
|
|
start = ext4_group_first_block_no(sb, block_group);
|
|
|
|
- if (ext4_has_feature_flex_bg(sb))
|
|
- flex_bg = 1;
|
|
-
|
|
/* Set bits for block and inode bitmaps, and inode table */
|
|
tmp = ext4_block_bitmap(sb, gdp);
|
|
- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
|
|
+ if (ext4_block_in_group(sb, tmp, block_group))
|
|
ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
|
|
|
|
tmp = ext4_inode_bitmap(sb, gdp);
|
|
- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
|
|
+ if (ext4_block_in_group(sb, tmp, block_group))
|
|
ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
|
|
|
|
tmp = ext4_inode_table(sb, gdp);
|
|
for (; tmp < ext4_inode_table(sb, gdp) +
|
|
sbi->s_itb_per_group; tmp++) {
|
|
- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
|
|
+ if (ext4_block_in_group(sb, tmp, block_group))
|
|
ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
|
|
}
|
|
|