• Eric Biggers's avatar
    ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS · a405a2a0
    Eric Biggers authored
    commit 349fa7d6 upstream.
    
    During the "insert range" fallocate operation, extents starting at the
    range offset are shifted "right" (to a higher file offset) by the range
    length.  But, as shown by syzbot, it's not validated that this doesn't
    cause extents to be shifted beyond EXT_MAX_BLOCKS.  In that case
    ->ee_block can wrap around, corrupting the extent tree.
    
    Fix it by returning an error if the space between the end of the last
    extent and EXT4_MAX_BLOCKS is smaller than the range being inserted.
    
    This bug can be reproduced by running the following commands when the
    current directory is on an ext4 filesystem with a 4k block size:
    
            fallocate -l 8192 file
            fallocate --keep-size -o 0xfffffffe000 -l 4096 -n file
            fallocate --insert-range -l 8192 file
    
    Then after unmounting the filesystem, e2fsck reports corruption.
    
    Reported-by: syzbot+06c885be0edcdaeab40c@syzkaller.appspotmail.com
    Fixes: 331573fe ("ext4: Add support FALLOC_FL_INSERT_RANGE for fallocate")
    Cc: stable@vger.kernel.org # v4.2+
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    a405a2a0
extents.c 163 KB