Commit 2e9cd9b8 authored by Ding Xiang's avatar Ding Xiang Committed by Zheng Zengkai
Browse files

ext4: make variable "count" signed 

stable inclusion
from stable-v5.10.124
commit 0ca74dacfd478a9c03361b7512be48ea6b22e8a5
category: bugfix
bugzilla: 186639, https://gitee.com/src-openeuler/kernel/issues/I58WSQ
CVE: CVE-2022-1184

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0ca74dacfd478a9c03361b7512be48ea6b22e8a5



--------------------------------

commit bc75a6eb upstream.

Since dx_make_map() may return -EFSCORRUPTED now, so change "count" to
be a signed integer so we can correctly check for an error code returned
by dx_make_map().

Fixes: 46c116b9 ("ext4: verify dir block before splitting it")
Cc: stable@kernel.org
Signed-off-by: default avatarDing Xiang <dingxiang@cmss.chinamobile.com>
Link: https://lore.kernel.org/r/20220530100047.537598-1-dingxiang@cmss.chinamobile.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 6713bdf0

fs/ext4/namei.c

+2 −1
Original line number Diff line number Diff line
@@ -1848,7 +1848,8 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, 
			struct dx_hash_info *hinfo)

{

	unsigned blocksize = dir->i_sb->s_blocksize;

	unsigned count, continued;

	unsigned continued;

	int count;

	struct buffer_head *bh2;

	ext4_lblk_t newblock;

	u32 hash2;