fs/ext2: Rework out-of-bounds read for inline and external extents
authorMichael Chang <mchang@suse.com>
Fri, 21 Feb 2025 01:06:12 +0000 (09:06 +0800)
committerFelix Zielcke <fzielcke@z-51.de>
Thu, 3 Jul 2025 16:35:51 +0000 (18:35 +0200)
commit65bd67c408094fb7b8746babf121c6455e95e0bf
treec3ad62d3480f87320dbd085fad8550a8d0b5a0ae
parentf3698d9b1336d16451c27c6a5b69f39511b8d222
fs/ext2: Rework out-of-bounds read for inline and external extents

Previously, the number of extent entries was not properly capped based
on the actual available space. This could lead to insufficient reads for
external extents, since the computation was based solely on the inline
extent layout.

In this patch, when processing the extent header, we determine whether
the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an
external extent block. We then clamp the number of entries accordingly
(using max_inline_ext for inline extents and max_external_ext for
external extent blocks).

This change ensures that only the valid number of extent entries is
processed, preventing out-of-bound reads and potential filesystem
corruption.

Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents)
Signed-off-by: Michael Chang <mchang@suse.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Rework-out-of-bounds-read-for-inline-and-external.patch
grub-core/fs/ext2.c