Commit ce3aba43 authored by Anirudh Rayabharam's avatar Anirudh Rayabharam Committed by Theodore Ts'o
Browse files

ext4: fix kernel infoleak via ext4_extent_header 

Initialize eh_generation of struct ext4_extent_header to prevent leaking
info to userspace. Fixes KMSAN kernel-infoleak bug reported by syzbot at:
http://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8



Cc: stable@kernel.org
Reported-by: default avatar <syzbot+2dcfeaf8cb49b05e8f1a@syzkaller.appspotmail.com>
Fixes: a86c6181 ("[PATCH] ext3: add extent map support")
Signed-off-by: default avatarAnirudh Rayabharam <mail@anirudhrb.com>
Link: https://lore.kernel.org/r/20210506185655.7118-1-mail@anirudhrb.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
parent 618f0031

fs/ext4/extents.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -825,6 +825,7 @@ void ext4_ext_tree_init(handle_t *handle, struct inode *inode) 
	eh->eh_entries = 0;

	eh->eh_entries = 0;

	eh->eh_magic = EXT4_EXT_MAGIC;

	eh->eh_magic = EXT4_EXT_MAGIC;

	eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode, 0));

	eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode, 0));

	eh->eh_generation = 0;

	ext4_mark_inode_dirty(handle, inode);

	ext4_mark_inode_dirty(handle, inode);

}

}
@@ -1090,6 +1091,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, 
	neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode, 0));

	neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode, 0));

	neh->eh_magic = EXT4_EXT_MAGIC;

	neh->eh_magic = EXT4_EXT_MAGIC;

	neh->eh_depth = 0;

	neh->eh_depth = 0;

	neh->eh_generation = 0;





	/* move remainder of path[depth] to the new leaf */

	/* move remainder of path[depth] to the new leaf */

	if (unlikely(path[depth].p_hdr->eh_entries !=

	if (unlikely(path[depth].p_hdr->eh_entries !=
@@ -1167,6 +1169,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, 
		neh->eh_magic = EXT4_EXT_MAGIC;

		neh->eh_magic = EXT4_EXT_MAGIC;

		neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode, 0));

		neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode, 0));

		neh->eh_depth = cpu_to_le16(depth - i);

		neh->eh_depth = cpu_to_le16(depth - i);

		neh->eh_generation = 0;

		fidx = EXT_FIRST_INDEX(neh);

		fidx = EXT_FIRST_INDEX(neh);

		fidx->ei_block = border;

		fidx->ei_block = border;

		ext4_idx_store_pblock(fidx, oldblock);

		ext4_idx_store_pblock(fidx, oldblock);