]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ocfs2: validate l_tree_depth to avoid out-of-bounds access
authorVasiliy Kovalev <kovalev@altlinux.org>
Fri, 14 Feb 2025 08:49:08 +0000 (11:49 +0300)
committerAndrew Morton <akpm@linux-foundation.org>
Mon, 17 Mar 2025 06:24:12 +0000 (23:24 -0700)
commita406aff8c05115119127c962cbbbbd202e1973ef
treefb97442484bd7da2c414b5d5f1150864d16bf44f
parentb4dc0bee2a749083028afba346910e198653f42a
ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is
limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid
value, which may occur when reading from a corrupted mounted disk [1].

Link: https://lkml.kernel.org/r/20250214084908.736528-1-kovalev@altlinux.org
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Reported-by: syzbot+66c146268dc88f4341fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=66c146268dc88f4341fd [1]
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Kurt Hackel <kurt.hackel@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Vasiliy Kovalev <kovalev@altlinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/ocfs2/alloc.c