summaryrefslogtreecommitdiff
path: root/fs/ext4/ext4_extents.h
diff options
context:
space:
mode:
authorTheodore Ts'o <tytso@mit.edu>2018-06-14 19:55:10 +0300
committerTheodore Ts'o <tytso@mit.edu>2018-06-14 19:55:10 +0300
commitbc890a60247171294acc0bd67d211fa4b88d40ba (patch)
treecb1aeb05ac0a8eb30f12d49c68da6f1a65187bc2 /fs/ext4/ext4_extents.h
parent8844618d8aa7a9973e7b527d038a2a589665002c (diff)
downloadlinux-bc890a60247171294acc0bd67d211fa4b88d40ba.tar.xz
ext4: verify the depth of extent tree in ext4_find_extent()
If there is a corupted file system where the claimed depth of the extent tree is -1, this can cause a massive buffer overrun leading to sadness. This addresses CVE-2018-10877. https://bugzilla.kernel.org/show_bug.cgi?id=199417 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org
Diffstat (limited to 'fs/ext4/ext4_extents.h')
-rw-r--r--fs/ext4/ext4_extents.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 98fb0c119c68..adf6668b596f 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -91,6 +91,7 @@ struct ext4_extent_header {
};
#define EXT4_EXT_MAGIC cpu_to_le16(0xf30a)
+#define EXT4_MAX_EXTENT_DEPTH 5
#define EXT4_EXTENT_TAIL_OFFSET(hdr) \
(sizeof(struct ext4_extent_header) + \