[RHEL7,COMMIT] ms/ext4: fix argument checking in EXT4_IOC_MOVE_EXT

Submitted by Vasily Averin on Dec. 3, 2020, 8:58 a.m.

Details

Message ID 202012030858.0B38wfeN001287@vz7build.vvs.sw.ru
State New
Series "ms/ext4: fix argument checking in EXT4_IOC_MOVE_EXT"
Headers show

Commit Message

Vasily Averin Dec. 3, 2020, 8:58 a.m. 
The commit is pushed to "branch-rh7-3.10.0-1160.6.1.vz7.171.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.6.1.vz7.171.1
------>
commit 596094c30656b00fffc96e86709863de581fad4f
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Thu Dec 3 11:58:41 2020 +0300

    ms/ext4: fix argument checking in EXT4_IOC_MOVE_EXT
    
    If the starting block number of either the source or destination file
    exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL.
    
    Also fixed the helper function mext_check_coverage() so that if the
    logical block is beyond EOF, make it return immediately, instead of
    looping until the block number wraps all the away around.  This takes
    long enough that if there are multiple threads trying to do pound on
    an the same inode doing non-sensical things, it can end up triggering
    the kernel's soft lockup detector.
    
    Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@kernel.org
    (cherry-picked from commit f18b2b83a727a3db208308057d2c7945f368e625)
    https://jira.sw.ru/browse/PSBM-122991
    Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
 fs/ext4/move_extent.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Patch hide | download patch | download mbox 

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 6c925d6..930c7bd 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -530,9 +530,13 @@  mext_check_arguments(struct inode *orig_inode,
 			orig_inode->i_ino, donor_inode->i_ino);
 		return -EINVAL;
 	}
-	if (orig_eof < orig_start + *len - 1)
+	if (orig_eof <= orig_start)
+		*len = 0;
+	else if (orig_eof < orig_start + *len - 1)
 		*len = orig_eof - orig_start;
-	if (donor_eof < donor_start + *len - 1)
+	if (donor_eof <= donor_start)
+		*len = 0;
+	else if (donor_eof < donor_start + *len - 1)
 		*len = donor_eof - donor_start;
 	if (!*len) {
 		ext4_debug("ext4 move extent: len should not be 0 "