Commit b46dc033 authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Jan Kara

ext2: reject inodes with negative size

Don't load an inode with a negative size; this causes integer overflow
problems in the VFS.
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent c3b00446
...@@ -1476,6 +1476,10 @@ struct inode *ext2_iget (struct super_block *sb, unsigned long ino) ...@@ -1476,6 +1476,10 @@ struct inode *ext2_iget (struct super_block *sb, unsigned long ino)
inode->i_size |= ((__u64)le32_to_cpu(raw_inode->i_size_high)) << 32; inode->i_size |= ((__u64)le32_to_cpu(raw_inode->i_size_high)) << 32;
else else
ei->i_dir_acl = le32_to_cpu(raw_inode->i_dir_acl); ei->i_dir_acl = le32_to_cpu(raw_inode->i_dir_acl);
if (i_size_read(inode) < 0) {
ret = -EFSCORRUPTED;
goto bad_inode;
}
ei->i_dtime = 0; ei->i_dtime = 0;
inode->i_generation = le32_to_cpu(raw_inode->i_generation); inode->i_generation = le32_to_cpu(raw_inode->i_generation);
ei->i_state = 0; ei->i_state = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment