mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-20 19:23:40 +00:00
636e8d85a3
[ Upstream commit356227096e] ext4_read_inline_page() does not validate that the inline data length fits within a page before copying data. If the inline size exceeds PAGE_SIZE due to filesystem corruption, this could lead to a kernel memory write beyond the page boundary. Add a bounds check after computing len, returning -EFSCORRUPTED if the value exceeds PAGE_SIZE. The upstream commit replaced a BUG_ON(len > PAGE_SIZE) in ext4_read_inline_folio(). In 6.1 and earlier, the function is still named ext4_read_inline_page() and the BUG_ON was never present, so this patch adds the bounds check directly. Fixes:46c7f25454("ext4: add read support for inline data") Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2112 lines
52 KiB
2112 lines
52 KiB