1From 8d66e7e9316002ca9f9d558069bd56ccba9cece8 Mon Sep 17 00:00:00 2001 2From: Theodore Ts'o <tytso@mit.edu> 3Date: Mon, 6 Jun 2022 22:44:35 -0400 4Subject: e2fsck: avoid out-of-bounds write for very deep extent trees 5MIME-Version: 1.0 6Content-Type: text/plain; charset=UTF-8 7Content-Transfer-Encoding: 8bit 8 9The kernel doesn't support extent trees deeper than 5 10(EXT4_MAX_EXTENT_DEPTH). For this reason we only maintain the extent 11tree statistics for 5 levels. Avoid out-of-bounds writes and reads if 12the extent tree is deeper than this. 13 14We keep these statistics to determine whether we should rebuild the 15extent tree. If the extent tree is too deep, we don't need the 16statistics because we should always rebuild the it. 17 18Reported-by: Nils Bars <nils.bars@rub.de> 19Reported-by: Moritz Schlögel <moritz.schloegel@rub.de> 20Reported-by: Nico Schiller <nico.schiller@rub.de> 21Signed-off-by: Theodore Ts'o <tytso@mit.edu> 22--- 23 e2fsck/extents.c | 10 +++++++++- 24 e2fsck/pass1.c | 3 ++- 25 2 files changed, 11 insertions(+), 2 deletions(-) 26 27diff --git a/e2fsck/extents.c b/e2fsck/extents.c 28index 01879f56..86fe00e7 100644 29--- a/e2fsck/extents.c 30+++ b/e2fsck/extents.c 31@@ -526,7 +526,8 @@ errcode_t e2fsck_check_rebuild_extents(e2fsck_t ctx, ext2_ino_t ino, 32 */ 33 if (info.curr_entry == 1 && 34 !(extent.e_flags & EXT2_EXTENT_FLAGS_SECOND_VISIT) && 35- !eti.force_rebuild) { 36+ !eti.force_rebuild && 37+ info.curr_level < MAX_EXTENT_DEPTH_COUNT) { 38 struct extent_tree_level *etl; 39 40 etl = eti.ext_info + info.curr_level; 41@@ -580,6 +581,13 @@ errcode_t e2fsck_should_rebuild_extents(e2fsck_t ctx, 42 extents_per_block = (ctx->fs->blocksize - 43 sizeof(struct ext3_extent_header)) / 44 sizeof(struct ext3_extent); 45+ 46+ /* If the extent tree is too deep, then rebuild it. */ 47+ if (info->max_depth > MAX_EXTENT_DEPTH_COUNT) { 48+ pctx->blk = info->max_depth; 49+ op = PR_1E_CAN_COLLAPSE_EXTENT_TREE; 50+ goto rebuild; 51+ } 52 /* 53 * If we can consolidate a level or shorten the tree, schedule the 54 * extent tree to be rebuilt. 55diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c 56index 11d7ce93..43972e7c 100644 57--- a/e2fsck/pass1.c 58+++ b/e2fsck/pass1.c 59@@ -2842,7 +2842,8 @@ static void scan_extent_node(e2fsck_t ctx, struct problem_context *pctx, 60 if (pctx->errcode) 61 return; 62 if (!(ctx->options & E2F_OPT_FIXES_ONLY) && 63- !pb->eti.force_rebuild) { 64+ !pb->eti.force_rebuild && 65+ info.curr_level < MAX_EXTENT_DEPTH_COUNT) { 66 struct extent_tree_level *etl; 67 68 etl = pb->eti.ext_info + info.curr_level; 69-- 70cgit 71 72