]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
nilfs2: fix potential oob read in nilfs_btree_check_delete()
authorRyusuke Konishi <konishi.ryusuke@gmail.com>
Wed, 4 Sep 2024 08:13:09 +0000 (17:13 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 4 Oct 2024 14:29:22 +0000 (16:29 +0200)
commit257f9e5185eb6de83377caea686c306e22e871f2
treecb2eeebda5bf0b31d96c1aa19b51f843fd39b811
parent0f28b3b51fc1d9ef0e768ce03d262ea88447344b
nilfs2: fix potential oob read in nilfs_btree_check_delete()

[ Upstream commit f9c96351aa6718b42a9f42eaf7adce0356bdb5e8 ]

The function nilfs_btree_check_delete(), which checks whether degeneration
to direct mapping occurs before deleting a b-tree entry, causes memory
access outside the block buffer when retrieving the maximum key if the
root node has no entries.

This does not usually happen because b-tree mappings with 0 child nodes
are never created by mkfs.nilfs2 or nilfs2 itself.  However, it can happen
if the b-tree root node read from a device is configured that way, so fix
this potential issue by adding a check for that case.

Link: https://lkml.kernel.org/r/20240904081401.16682-4-konishi.ryusuke@gmail.com
Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: Lizhi Xu <lizhi.xu@windriver.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nilfs2/btree.c