Commit 28d0dff5 authored by Luis Henriques (SUSE)'s avatar Luis Henriques (SUSE) Committed by Zhihao Cheng
Browse files

ext4: fix infinite loop when replaying fast_commit 

mainline inclusion
from mainline-v6.11-rc1
commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X
CVE: CVE-2024-43828

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=907c3fe532253a6ef4eb9c4d67efb71fab58c706



--------------------------------

When doing fast_commit replay an infinite loop may occur due to an
uninitialized extent_status struct.  ext4_ext_determine_insert_hole() does
not detect the replay and calls ext4_es_find_extent_range(), which will
return immediately without initializing the 'es' variable.

Because 'es' contains garbage, an integer overflow may happen causing an
infinite loop in this function, easily reproducible using fstest generic/039.

This commit fixes this issue by unconditionally initializing the structure
in function ext4_es_find_extent_range().

Thanks to Zhang Yi, for figuring out the real problem!

Fixes: 8016e29f ("ext4: fast commit recovery path")
Signed-off-by: default avatarLuis Henriques (SUSE) <luis.henriques@linux.dev>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarZhihao Cheng <chengzhihao@huaweicloud.com>
parent 6b96457d

fs/ext4/extents_status.c

+2 −0
Original line number Diff line number Diff line
@@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, 
			       ext4_lblk_t lblk, ext4_lblk_t end,

			       struct extent_status *es)

{

	es->es_lblk = es->es_len = es->es_pblk = 0;



	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)

		return;