github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ext4: fix orig_mlen initialization in ext4_map_blocks()

Browse Source 
Save orig_mlen after clamping map->m_len to INT_MAX. Otherwise, the
unclamped value may be passed below, bypassing its overflow protection.

Fixes: 5bb12b1837 ("ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Tested-by: syzbot@syzkaller.appspotmail.com
Link: https://patch.msgid.link/20261009103033.2920530-6-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
Zhang Yi 2026-10-09 18:30:06 +08:00 committed by Theodore Ts'o
parent ecabe6bd61
commit 3ec0eefc07
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/ext4/inode.c
View File

@ -703,7 +703,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
struct extent_status es;
int retval;
int ret = 0;
unsigned int orig_mlen = map->m_len;
unsigned int orig_mlen;
#ifdef ES_AGGRESSIVE_TEST
struct ext4_map_blocks orig_map;
@ -719,6 +719,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
*/
if (unlikely(map->m_len > INT_MAX))
map->m_len = INT_MAX;
orig_mlen = map->m_len;
/* We can handle the block number less than EXT_MAX_BLOCKS */
if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))