]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ext4: verify the depth of extent tree in ext4_find_extent()
authorTheodore Ts'o <tytso@mit.edu>
Thu, 14 Jun 2018 16:55:10 +0000 (12:55 -0400)
committerBrian Maly <brian.maly@oracle.com>
Wed, 27 Feb 2019 19:46:52 +0000 (14:46 -0500)
commit5260d11397fa87e1399cc152bbe4a8ae86dcee10
tree4c74e0a304de28e6a3278a896b7d464239297fef
parent5f55c8235c0d868dc322b79c53aaa50767857689
ext4: verify the depth of extent tree in ext4_find_extent()

commit bc890a60247171294acc0bd67d211fa4b88d40ba upstream.

If there is a corupted file system where the claimed depth of the
extent tree is -1, this can cause a massive buffer overrun leading to
sadness.

This addresses CVE-2018-10877.

https://bugzilla.kernel.org/show_bug.cgi?id=199417

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit d69a9df614fc68741efcb0fcc020f05caa99d668)

Orabug: 29396712
CVE:CVE-2018-10877

Signed-off-by: John Donnelly <John.P.Donnelly@oracle.com>
Reviewed-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
fs/ext4/ext4_extents.h
fs/ext4/extents.c