diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2019-11-07 21:43:41 -0500 |
|---|---|---|
| committer | Jeferson Oliveira <jroliveira.oliveira301@gmail.com> | 2021-08-17 21:09:21 +0200 |
| commit | ef4da7c764b5522eff752ecf9c4cd0f13b9a875f (patch) | |
| tree | 759527255b5f187209df8c983e83e05540e84c1c /fs/select.c | |
| parent | 814099733bbbd11983ece384c1930b42621233fd (diff) | |
commit 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a upstream.
It's possible to specify a non-zero s_want_extra_isize via debugging
option, and this can cause bad things(tm) to happen when using a file
system with an inode size of 128 bytes.
Add better checking when the file system is mounted, as well as when
we are actually doing the trying to do the inode expansion.
Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu
Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com
Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com
Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.16:
- Use EIO instead of EFSCORRUPTED
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2019-19767
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: I0eaa4612f0c3c11951128c8a5fb1536bd6e0f12b
Diffstat (limited to 'fs/select.c')
0 files changed, 0 insertions, 0 deletions