Commit e5d39597 authored by Chengguang Xu's avatar Chengguang Xu Committed by Jan Kara

ext2: fix block range in ext2_data_block_valid()

For block validity we should check the block range
from start_block to start_block + count - 1, so fix
the range in ext2_data_block_valid() and also modify
the count argument properly in calling place.
Signed-off-by: default avatarChengguang Xu <cgxu519@zoho.com.cn>
Link: https://lore.kernel.org/r/20190723112155.20329-1-cgxu519@zoho.com.cnSigned-off-by: default avatarJan Kara <jack@suse.cz>
parent 6fbacb85
...@@ -1203,13 +1203,13 @@ int ext2_data_block_valid(struct ext2_sb_info *sbi, ext2_fsblk_t start_blk, ...@@ -1203,13 +1203,13 @@ int ext2_data_block_valid(struct ext2_sb_info *sbi, ext2_fsblk_t start_blk,
unsigned int count) unsigned int count)
{ {
if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) || if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
(start_blk + count < start_blk) || (start_blk + count - 1 < start_blk) ||
(start_blk > le32_to_cpu(sbi->s_es->s_blocks_count))) (start_blk + count - 1 >= le32_to_cpu(sbi->s_es->s_blocks_count)))
return 0; return 0;
/* Ensure we do not step over superblock */ /* Ensure we do not step over superblock */
if ((start_blk <= sbi->s_sb_block) && if ((start_blk <= sbi->s_sb_block) &&
(start_blk + count >= sbi->s_sb_block)) (start_blk + count - 1 >= sbi->s_sb_block))
return 0; return 0;
return 1; return 1;
......
...@@ -794,7 +794,7 @@ ext2_xattr_delete_inode(struct inode *inode) ...@@ -794,7 +794,7 @@ ext2_xattr_delete_inode(struct inode *inode)
if (!EXT2_I(inode)->i_file_acl) if (!EXT2_I(inode)->i_file_acl)
goto cleanup; goto cleanup;
if (!ext2_data_block_valid(sbi, EXT2_I(inode)->i_file_acl, 0)) { if (!ext2_data_block_valid(sbi, EXT2_I(inode)->i_file_acl, 1)) {
ext2_error(inode->i_sb, "ext2_xattr_delete_inode", ext2_error(inode->i_sb, "ext2_xattr_delete_inode",
"inode %ld: xattr block %d is out of data blocks range", "inode %ld: xattr block %d is out of data blocks range",
inode->i_ino, EXT2_I(inode)->i_file_acl); inode->i_ino, EXT2_I(inode)->i_file_acl);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment