ext4: fix error code return to user-space in ext4_get_branch()

commit 26d75a16af285a70863ba6a81f85d81e7e65da50 upstream.

If a block is out of range in ext4_get_branch(), -ENOMEM will be returned
to user-space.  Obviously, this error code isn't really useful.  This
patch fixes it by making sure the right error code (-EFSCORRUPTED) is
propagated to user-space.  EUCLEAN is more informative than ENOMEM.

Signed-off-by: Luís Henriques <lhenriques@suse.de>
Link: https://lore.kernel.org/r/20221109181445.17843-1-lhenriques@suse.de
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index ff7e1ac6ee530f8609582d09402a978e8ae708cf..30165eb46c32b7a1e4b42fc707cfadcc7243d943 100644 (file)
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -147,6 +147,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth,
        struct super_block *sb = inode->i_sb;
        Indirect *p = chain;
        struct buffer_head *bh;
+       unsigned int key;
        int ret = -EIO;
 
        *err = 0;
@@ -155,7 +156,13 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth,
        if (!p->key)
                goto no_block;
        while (--depth) {
-               bh = sb_getblk(sb, le32_to_cpu(p->key));
+               key = le32_to_cpu(p->key);
+               if (key > ext4_blocks_count(EXT4_SB(sb)->s_es)) {
+                       /* the block was out of range */
+                       ret = -EFSCORRUPTED;
+                       goto failure;
+               }
+               bh = sb_getblk(sb, key);
                if (unlikely(!bh)) {
                        ret = -ENOMEM;
                        goto failure;