Commit aeabdb73 authored by Baokun Li's avatar Baokun Li Committed by Yifan Qiao
Browse files

ext4: set the type of max_zeroout to unsigned int to avoid overflow 

mainline inclusion
from mainline-v6.10-rc1
commit 261341a932d9244cbcd372a3659428c8723e5a49
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD018
CVE: CVE-2024-40955

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=261341a932d9244cbcd372a3659428c8723e5a49



--------------------------------

The max_zeroout is of type int and the s_extent_max_zeroout_kb is of
type uint, and the s_extent_max_zeroout_kb can be freely modified via
the sysfs interface. When the block size is 1024, max_zeroout may
overflow, so declare it as unsigned int to avoid overflow.

Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240319113325.3110393-9-libaokun1@huawei.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent b5b440c4

fs/ext4/extents.c

+2 −1
Original line number Diff line number Diff line
@@ -3413,9 +3413,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle, 
	struct ext4_extent *ex, *abut_ex;

	ext4_lblk_t ee_block, eof_block;

	unsigned int ee_len, depth, map_len = map->m_len;

	int allocated = 0, max_zeroout = 0;

	int err = 0;

	int split_flag = EXT4_EXT_DATA_VALID2;

	int allocated = 0;

	unsigned int max_zeroout = 0;



	ext_debug(inode, "logical block %llu, max_blocks %u\n",

		  (unsigned long long)map->m_lblk, map_len);