Vasiliy Kovalev 3d012ba440 ocfs2: validate l_tree_depth to avoid out-of-bounds access ...

[ Upstream commit a406aff8c05115119127c962cbbbbd202e1973ef ]

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is
limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid
value, which may occur when reading from a corrupted mounted disk [1].

Link: https://lkml.kernel.org/r/20250214084908.736528-1-kovalev@altlinux.org
Fixes: ccd979bdbc ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Reported-by: syzbot+66c146268dc88f4341fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=66c146268dc88f4341fd [1]
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Kurt Hackel <kurt.hackel@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Vasiliy Kovalev <kovalev@altlinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-04-10 14:37:34 +02:00

..

cluster

ocfs2: cluster: fix potential deadlock on &o2net_debug_lock

2023-08-18 10:18:59 -07:00

dlm

ocfs2/dlm: use bitmap API instead of hand-writing it

2022-11-18 13:55:06 -08:00

dlmfs

ocfs2: convert to new timestamp accessors

2024-06-27 13:49:14 +02:00

acl.c

ocfs2: convert to new timestamp accessors

2024-06-27 13:49:14 +02:00

acl.h

fs: port ->set_acl() to pass mnt_idmap

2023-01-19 09:24:27 +01:00

alloc.c

ocfs2: validate l_tree_depth to avoid out-of-bounds access

2025-04-10 14:37:34 +02:00

alloc.h

…

aops.c

ocfs2: fix uninit-value in ocfs2_get_block()

2024-10-10 11:57:51 +02:00

aops.h

ocfs2: fix uninitialized value in ocfs2_file_read_iter()

2024-12-09 10:32:20 +01:00

blockcheck.c

…

blockcheck.h

…

buffer_head_io.c

ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate

2024-10-10 11:57:51 +02:00

buffer_head_io.h

…

dcache.c

…

dcache.h

…

dir.c

ocfs2: check dir i_size in ocfs2_find_entry

2025-02-17 09:40:42 +01:00

dir.h

…

dlmglue.c

ocfs2: update seq_file index in ocfs2_dlm_seq_next

2024-12-14 19:59:57 +01:00

dlmglue.h

…

export.c

…

export.h

…

extent_map.c

ocfs2: fix deadlock in ocfs2_get_system_file_inode

2025-01-23 17:21:18 +01:00

extent_map.h

…

file.c

ocfs2: fix uninitialized value in ocfs2_file_read_iter()

2024-12-09 10:32:20 +01:00

file.h

fs: port ->permission() to pass mnt_idmap

2023-01-19 09:24:28 +01:00

filecheck.c

…

filecheck.h

…

heartbeat.c

…

heartbeat.h

…

inode.c

ocfs2: convert to new timestamp accessors

2024-06-27 13:49:14 +02:00

inode.h

quota: Properly annotate i_dquot arrays with __rcu

2024-03-26 18:19:46 -04:00

ioctl.c

ocfs2: reduce ioctl stack usage

2023-04-21 14:54:34 -07:00

ioctl.h

fs: port ->fileattr_set() to pass mnt_idmap

2023-01-19 09:24:27 +01:00

journal.c

ocfs2: fix null-ptr-deref when journal load failed.

2024-10-10 11:57:51 +02:00

journal.h

ocfs2: fix DIO failure due to insufficient transaction credits

2024-07-05 09:33:54 +02:00

Kconfig

fs: add CONFIG_BUFFER_HEAD

2023-08-02 09:13:09 -06:00

localalloc.c

ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"

2024-12-14 20:00:22 +01:00

localalloc.h

…

locks.c

filelock: move file locking definitions to separate header file

2023-01-11 06:52:32 -05:00

locks.h

…

Makefile

…

mmap.c

…

mmap.h

…

move_extents.c

ocfs2: convert to new timestamp accessors

2024-06-27 13:49:14 +02:00

move_extents.h

…

namei.c

ocfs2: free inode when ocfs2_get_init_inode() fails

2024-12-14 19:59:50 +01:00

namei.h

…

ocfs1_fs_compat.h

…

ocfs2_fs.h

…

ocfs2_ioctl.h

…

ocfs2_lockid.h

…

ocfs2_lockingver.h

…

ocfs2_trace.h

ocfs2: fix DIO failure due to insufficient transaction credits

2024-07-05 09:33:54 +02:00

ocfs2.h

ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()

2024-06-27 13:49:12 +02:00

quota_global.c

ocfs2: mark dquot as inactive if failed to start trans while releasing dquot

2025-02-08 09:52:26 +01:00

quota_local.c

ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv

2025-01-09 13:32:07 +01:00

quota.h

…

refcounttree.c

ocfs2: reserve space for inline xattr before attaching reflink tree

2024-10-10 11:57:51 +02:00

refcounttree.h

…

reservations.c

…

reservations.h

…

resize.c

ocfs2: uncache inode which has failed entering the group

2024-11-22 15:38:33 +01:00

resize.h

…

slot_map.c

…

slot_map.h

…

stack_o2cb.c

ocfs2: use bitmap API in fill_node_map

2022-11-18 13:55:06 -08:00

stack_user.c

fs: dlm: fix F_CANCELLK to cancel pending request

2023-07-20 17:25:04 -05:00

stackglue.c

ocfs2: fix memory leak in ocfs2_stack_glue_init()

2022-11-18 13:55:09 -08:00

stackglue.h

…

suballoc.c

…

suballoc.h

…

super.c

ocfs2: fix incorrect CPU endianness conversion causing mount failure

2025-02-17 09:40:37 +01:00

super.h

…

symlink.c

ocfs2: handle a symlink read error correctly

2025-02-17 09:40:37 +01:00

symlink.h

…

sysfile.c

…

sysfile.h

…

uptodate.c

…

uptodate.h

…

xattr.c

ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()

2024-11-14 13:19:40 +01:00

xattr.h

…