Commit dab1bc4a authored by Baokun Li's avatar Baokun Li Committed by Yifan Qiao
Browse files

ext4: unify the type of flexbg_size to unsigned int 

stable inclusion
from stable-v5.10.210
commit b9601924226976c610e8966ea71e7b9314fb41c7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV4P
CVE: CVE-2023-52622

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b9601924226976c610e8966ea71e7b9314fb41c7



--------------------------------

[ Upstream commit 658a52344fb139f9531e7543a6e0015b630feb38 ]

The maximum value of flexbg_size is 2^31, but the maximum value of int
is (2^31 - 1), so overflow may occur when the type of flexbg_size is
declared as int.

For example, when uninit_mask is initialized in ext4_alloc_group_tables(),
if flexbg_size == 2^31, the initialized uninit_mask is incorrect, and this
may causes set_flexbg_block_bitmap() to trigger a BUG_ON().

Therefore, the flexbg_size type is declared as unsigned int to avoid
overflow and memory waste.

Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20231023013057.2117948-2-libaokun1@huawei.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLin Yujun <linyujun809@huawei.com>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent 44c9bb16

fs/ext4/resize.c

+7 −6
Original line number Diff line number Diff line
@@ -237,7 +237,7 @@ struct ext4_new_flex_group_data { 
 *

 * Returns NULL on failure otherwise address of the allocated structure.

 */

static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)

static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)

{

	struct ext4_new_flex_group_data *flex_gd;
@@ -289,7 +289,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd) 
 */

static int ext4_alloc_group_tables(struct super_block *sb,

				struct ext4_new_flex_group_data *flex_gd,

				int flexbg_size)

				unsigned int flexbg_size)

{

	struct ext4_new_group_data *group_data = flex_gd->groups;

	ext4_fsblk_t start_blk;
@@ -390,12 +390,12 @@ static int ext4_alloc_group_tables(struct super_block *sb, 
		group = group_data[0].group;



		printk(KERN_DEBUG "EXT4-fs: adding a flex group with "

		       "%d groups, flexbg size is %d:\n", flex_gd->count,

		       "%u groups, flexbg size is %u:\n", flex_gd->count,

		       flexbg_size);



		for (i = 0; i < flex_gd->count; i++) {

			ext4_debug(

			       "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n",

			       "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n",

			       ext4_bg_has_super(sb, group + i) ? "normal" :

			       "no-super", group + i,

			       group_data[i].blocks_count,
@@ -1569,7 +1569,7 @@ static int ext4_flex_group_add(struct super_block *sb, 
static int ext4_setup_next_flex_gd(struct super_block *sb,

				    struct ext4_new_flex_group_data *flex_gd,

				    ext4_fsblk_t n_blocks_count,

				    unsigned long flexbg_size)

				    unsigned int flexbg_size)

{

	struct ext4_sb_info *sbi = EXT4_SB(sb);

	struct ext4_super_block *es = sbi->s_es;
@@ -1953,8 +1953,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) 
	ext4_fsblk_t o_blocks_count;

	ext4_fsblk_t n_blocks_count_retry = 0;

	unsigned long last_update_time = 0;

	int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex;

	int err = 0;

	int meta_bg;

	unsigned int flexbg_size = ext4_flex_bg_size(sbi);



	/* See if the device is actually as big as what was requested */

	bh = ext4_sb_bread(sb, n_blocks_count - 1, 0);