releases/4.19.45/ext4-make-sanity-check-in-mballoc-more-strict.patch

   1 From 31562b954b60f02acb91b7349dc6432d3f8c3c5f Mon Sep 17 00:00:00 2001
   2 From: Jan Kara <jack@suse.cz>
   3 Date: Sat, 6 Apr 2019 18:33:06 -0400
   4 Subject: ext4: make sanity check in mballoc more strict
   5
   6 From: Jan Kara <jack@suse.cz>
   7
   8 commit 31562b954b60f02acb91b7349dc6432d3f8c3c5f upstream.
   9
  10 The sanity check in mb_find_extent() only checked that returned extent
  11 does not extend past blocksize * 8, however it should not extend past
  12 EXT4_CLUSTERS_PER_GROUP(sb). This can happen when clusters_per_group <
  13 blocksize * 8 and the tail of the bitmap is not properly filled by 1s
  14 which happened e.g. when ancient kernels have grown the filesystem.
  15
  16 Signed-off-by: Jan Kara <jack@suse.cz>
  17 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  18 Cc: stable@kernel.org
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20
  21 ---
  22  fs/ext4/mballoc.c |    2 +-
  23  1 file changed, 1 insertion(+), 1 deletion(-)
  24
  25 --- a/fs/ext4/mballoc.c
  26 +++ b/fs/ext4/mballoc.c
  27 @@ -1539,7 +1539,7 @@ static int mb_find_extent(struct ext4_bu
  28                 ex->fe_len += 1 << order;
  29         }
  30
  31 -       if (ex->fe_start + ex->fe_len > (1 << (e4b->bd_blkbits + 3))) {
  32 +       if (ex->fe_start + ex->fe_len > EXT4_CLUSTERS_PER_GROUP(e4b->bd_sb)) {
  33                 /* Should never happen! (but apparently sometimes does?!?) */
  34                 WARN_ON(1);
  35                 ext4_error(e4b->bd_sb, "corruption or bug in mb_find_extent "