Unverified Commit 6726609c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5581 CVE-2023-52622 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FR62H2NSAINT5ZPSVLTND46YP6HOKTCT/ 
Baokun Li (3):
  ext4: remove unnecessary check from alloc_flex_gd()
  ext4: unify the type of flexbg_size to unsigned int
  ext4: avoid online resizing failures due to oversized flex bg


-- 
2.39.2
 
https://gitee.com/src-openeuler/kernel/issues/I9BV4P 
 
Link:https://gitee.com/openeuler/kernel/pulls/5581

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 6034209e 0857995b

fs/ext4/resize.c

+22 −15
Original line number Diff line number Diff line
@@ -227,17 +227,24 @@ struct ext4_new_flex_group_data { 
						   in the flex group */

	__u16 *bg_flags;			/* block group flags of groups

						   in @groups */

	ext4_group_t resize_bg;			/* number of allocated

						   new_group_data */

	ext4_group_t count;			/* number of groups in @groups

						 */

};



/*

 * Avoiding memory allocation failures due to too many groups added each time.

 */

#define MAX_RESIZE_BG				16384



/*

 * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of

 * @flexbg_size.

 *

 * Returns NULL on failure otherwise address of the allocated structure.

 */

static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)

static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)

{

	struct ext4_new_flex_group_data *flex_gd;
@@ -245,17 +252,18 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size) 
	if (flex_gd == NULL)

		goto out3;



	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data))

		goto out2;

	flex_gd->count = flexbg_size;

	if (unlikely(flexbg_size > MAX_RESIZE_BG))

		flex_gd->resize_bg = MAX_RESIZE_BG;

	else

		flex_gd->resize_bg = flexbg_size;



	flex_gd->groups = kmalloc_array(flexbg_size,

	flex_gd->groups = kmalloc_array(flex_gd->resize_bg,

					sizeof(struct ext4_new_group_data),

					GFP_NOFS);

	if (flex_gd->groups == NULL)

		goto out2;



	flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16),

	flex_gd->bg_flags = kmalloc_array(flex_gd->resize_bg, sizeof(__u16),

					  GFP_NOFS);

	if (flex_gd->bg_flags == NULL)

		goto out1;
@@ -292,7 +300,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd) 
 */

static int ext4_alloc_group_tables(struct super_block *sb,

				struct ext4_new_flex_group_data *flex_gd,

				int flexbg_size)

				unsigned int flexbg_size)

{

	struct ext4_new_group_data *group_data = flex_gd->groups;

	ext4_fsblk_t start_blk;
@@ -393,12 +401,12 @@ static int ext4_alloc_group_tables(struct super_block *sb, 
		group = group_data[0].group;



		printk(KERN_DEBUG "EXT4-fs: adding a flex group with "

		       "%d groups, flexbg size is %d:\n", flex_gd->count,

		       "%u groups, flexbg size is %u:\n", flex_gd->count,

		       flexbg_size);



		for (i = 0; i < flex_gd->count; i++) {

			ext4_debug(

			       "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n",

			       "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n",

			       ext4_bg_has_super(sb, group + i) ? "normal" :

			       "no-super", group + i,

			       group_data[i].blocks_count,
@@ -1573,8 +1581,7 @@ static int ext4_flex_group_add(struct super_block *sb, 


static int ext4_setup_next_flex_gd(struct super_block *sb,

				    struct ext4_new_flex_group_data *flex_gd,

				    ext4_fsblk_t n_blocks_count,

				    unsigned long flexbg_size)

				    ext4_fsblk_t n_blocks_count)

{

	struct ext4_sb_info *sbi = EXT4_SB(sb);

	struct ext4_super_block *es = sbi->s_es;
@@ -1598,7 +1605,7 @@ static int ext4_setup_next_flex_gd(struct super_block *sb, 
	BUG_ON(last);

	ext4_get_group_no_and_offset(sb, n_blocks_count - 1, &n_group, &last);



	last_group = group | (flexbg_size - 1);

	last_group = group | (flex_gd->resize_bg - 1);

	if (last_group > n_group)

		last_group = n_group;
@@ -1962,8 +1969,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) 
	ext4_fsblk_t o_blocks_count;

	ext4_fsblk_t n_blocks_count_retry = 0;

	unsigned long last_update_time = 0;

	int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex;

	int err = 0;

	int meta_bg;

	unsigned int flexbg_size = ext4_flex_bg_size(sbi);



	/* See if the device is actually as big as what was requested */

	bh = ext4_sb_bread(sb, n_blocks_count - 1, 0);
@@ -2104,8 +2112,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) 
	/* Add flex groups. Note that a regular group is a

	 * flex group with 1 group.

	 */

	while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count,

					      flexbg_size)) {

	while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count)) {

		if (jiffies - last_update_time > HZ * 10) {

			if (last_update_time)

				ext4_msg(sb, KERN_INFO,