linux-kernel - Re: [PATCH v2 4/4] ext4: ensure i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1fd6eaa8-6e8a-44df-a00d-dfa42f2b81ce@huawei.com>
Date: Tue, 6 May 2025 15:42:29 +0800
From: Baokun Li <libaokun1@...wei.com>
To: Zhang Yi <yi.zhang@...weicloud.com>
CC: <linux-ext4@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <tytso@....edu>, <adilger.kernel@...ger.ca>,
	<jack@...e.cz>, <wanghaichi0403@...il.com>, <yi.zhang@...wei.com>,
	<yukuai3@...wei.com>, <yangerkun@...wei.com>
Subject: Re: [PATCH v2 4/4] ext4: ensure i_size is smaller than maxbytes

On 2025/5/6 9:20, Zhang Yi wrote:
> From: Zhang Yi <yi.zhang@...wei.com>
>
> The inode i_size cannot be larger than maxbytes, check it while loading
> inode from the disk.
>
> Signed-off-by: Zhang Yi <yi.zhang@...wei.com>
> Reviewed-by: Jan Kara <jack@...e.cz>
Looks good to me.

Reviewed-by: Baokun Li <libaokun1@...wei.com>
> ---
>   fs/ext4/inode.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 5691966a19e1..072b61140d12 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -4922,7 +4922,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
>   		ei->i_file_acl |=
>   			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
>   	inode->i_size = ext4_isize(sb, raw_inode);
> -	if ((size = i_size_read(inode)) < 0) {
> +	size = i_size_read(inode);
> +	if (size < 0 || size > ext4_get_maxbytes(inode)) {
>   		ext4_error_inode(inode, function, line, 0,
>   				 "iget: bad i_size value: %lld", size);
>   		ret = -EFSCORRUPTED;