fs/ext2: Rework out-of-bounds read for inline and external extents
authorMichael Chang <mchang@suse.com>
Fri, 21 Feb 2025 01:06:12 +0000 (09:06 +0800)
committerFelix Zielcke <fzielcke@z-51.de>
Wed, 11 Jun 2025 15:42:34 +0000 (17:42 +0200)
commiteb2f76b77405ff0805e9744d25095bc215e38803
tree0dd30a869f88c534720ee1f134e93d29b305408b
parentb76c6b7cae8751928d97e631bbbee267c70d8e44
fs/ext2: Rework out-of-bounds read for inline and external extents

Previously, the number of extent entries was not properly capped based
on the actual available space. This could lead to insufficient reads for
external extents, since the computation was based solely on the inline
extent layout.

In this patch, when processing the extent header, we determine whether
the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an
external extent block. We then clamp the number of entries accordingly
(using max_inline_ext for inline extents and max_external_ext for
external extent blocks).

This change ensures that only the valid number of extent entries is
processed, preventing out-of-bound reads and potential filesystem
corruption.

Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents)
Signed-off-by: Michael Chang <mchang@suse.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Rework-out-of-bounds-read-for-inline-and-external.patch
grub-core/fs/ext2.c