Commit b46dc033 authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Jan Kara
Browse files

ext2: reject inodes with negative size 



Don't load an inode with a negative size; this causes integer overflow
problems in the VFS.

Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent c3b00446

fs/ext2/inode.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -1476,6 +1476,10 @@ struct inode *ext2_iget (struct super_block *sb, unsigned long ino) 
		inode->i_size |= ((__u64)le32_to_cpu(raw_inode->i_size_high)) << 32;

		inode->i_size |= ((__u64)le32_to_cpu(raw_inode->i_size_high)) << 32;

	else

	else

		ei->i_dir_acl = le32_to_cpu(raw_inode->i_dir_acl);

		ei->i_dir_acl = le32_to_cpu(raw_inode->i_dir_acl);

	if (i_size_read(inode) < 0) {

		ret = -EFSCORRUPTED;

		goto bad_inode;

	}

	ei->i_dtime = 0;

	ei->i_dtime = 0;

	inode->i_generation = le32_to_cpu(raw_inode->i_generation);

	inode->i_generation = le32_to_cpu(raw_inode->i_generation);

	ei->i_state = 0;

	ei->i_state = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE