fs/ext2: Rework out-of-bounds read for inline and external extents
authorMichael Chang <mchang@suse.com>
Fri, 21 Feb 2025 01:06:12 +0000 (09:06 +0800)
committerAurelien Jarno <aurel32@debian.org>
Thu, 30 Apr 2026 19:02:01 +0000 (21:02 +0200)
commit00c7843080dda33be13fb9294d2c702964c7e294
tree11f2b0d459356a8bc00bf4d4695b0d70bfdc6d24
parent8cb0c5aa42d7d2c52408232385334a3c193dec1a
fs/ext2: Rework out-of-bounds read for inline and external extents

Previously, the number of extent entries was not properly capped based
on the actual available space. This could lead to insufficient reads for
external extents, since the computation was based solely on the inline
extent layout.

In this patch, when processing the extent header, we determine whether
the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an
external extent block. We then clamp the number of entries accordingly
(using max_inline_ext for inline extents and max_external_ext for
external extent blocks).

This change ensures that only the valid number of extent entries is
processed, preventing out-of-bound reads and potential filesystem
corruption.

Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents)
Signed-off-by: Michael Chang <mchang@suse.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Rework-out-of-bounds-read-for-inline-and-external.patch
grub-core/fs/ext2.c