ext4: fix argument checking in EXT4_IOC_MOVE_EXT
authorTheodore Ts'o <tytso@mit.edu>
Tue, 2 Oct 2018 05:34:44 +0000 (01:34 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 13 Nov 2018 19:08:35 +0000 (11:08 -0800)
commit3d267c56c75c9304d0b6cc9d0f129fbf4a835b07
tree7f3a2bdcabec12172bb7c58d30e0f1b1b3cac4cf
parent80fd75d30e576e8f219c6b3e6e54d133e909227a
ext4: fix argument checking in EXT4_IOC_MOVE_EXT

[ Upstream commit f18b2b83a727a3db208308057d2c7945f368e625 ]

If the starting block number of either the source or destination file
exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL.

Also fixed the helper function mext_check_coverage() so that if the
logical block is beyond EOF, make it return immediately, instead of
looping until the block number wraps all the away around.  This takes
long enough that if there are multiple threads trying to do pound on
an the same inode doing non-sensical things, it can end up triggering
the kernel's soft lockup detector.

Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ext4/move_extent.c