aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Sandeen <sandeen@redhat.com>2020-06-17 14:19:04 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-08-26 10:40:58 +0200
commitea54176e5821936d109bb45dc2c19bd53559e735 (patch)
tree0de9decfd40229e6d448a407206231375f239564
parent2585402c5799611064494062e9d43739867fc0d9 (diff)
downloadlinux-yocto-ea54176e5821936d109bb45dc2c19bd53559e735.tar.gz
linux-yocto-ea54176e5821936d109bb45dc2c19bd53559e735.tar.bz2
linux-yocto-ea54176e5821936d109bb45dc2c19bd53559e735.zip
ext4: fix potential negative array index in do_split()
[ Upstream commit 5872331b3d91820e14716632ebb56b1399b34fe1 ] If for any reason a directory passed to do_split() does not have enough active entries to exceed half the size of the block, we can end up iterating over all "count" entries without finding a split point. In this case, count == move, and split will be zero, and we will attempt a negative index into map[]. Guard against this by detecting this case, and falling back to split-to-half-of-count instead; in this case we will still have plenty of space (> half blocksize) in each split block. Fixes: ef2b02d3e617 ("ext34: ensure do_split leaves enough free space in both blocks") Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Andreas Dilger <adilger@dilger.ca> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/f53e246b-647c-64bb-16ec-135383c70ad7@redhat.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r--fs/ext4/namei.c16
1 files changed, 13 insertions, 3 deletions
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 0218b1407abb..36a81b57012a 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1852,7 +1852,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
blocksize, hinfo, map);
map -= count;
dx_sort_map(map, count);
- /* Split the existing block in the middle, size-wise */
+ /* Ensure that neither split block is over half full */
size = 0;
move = 0;
for (i = count-1; i >= 0; i--) {
@@ -1862,8 +1862,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
size += map[i].size;
move++;
}
- /* map index at which we will split */
- split = count - move;
+ /*
+ * map index at which we will split
+ *
+ * If the sum of active entries didn't exceed half the block size, just
+ * split it in half by count; each resulting block will have at least
+ * half the space free.
+ */
+ if (i > 0)
+ split = count - move;
+ else
+ split = count/2;
+
hash2 = map[split].hash;
continued = hash2 == map[split - 1].hash;
dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",