[Devel] [PATCH RHEL7 COMMIT] ext4: fix out of bounds access in ext4_alloc_group_desc_bh_array()

[Konstantin Khorenko]

In fact the patch has been merged with "ext4: replace ext4_kvmalloc() with kvmalloc()"
in vz7.70.2.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 08/13/2018 02:00 PM, Konstantin Khorenko wrote:
> The commit is pushed to "branch-rh7-3.10.0-862.9.1.vz7.70.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
> after rh7-3.10.0-862.9.1.vz7.70.1
> ------>
> commit 5bb34796595cdba1caa7bad6a172cdc468bd9562
> Author: Jan Dakinevich <jan.dakinevich at virtuozzo.com>
> Date:   Mon Aug 13 14:00:31 2018 +0300
>
>     ext4: fix out of bounds access in ext4_alloc_group_desc_bh_array()
>
>     https://jira.sw.ru/browse/PSBM-87413
>     Fixes: d695abe ("ext4: replace ext4_kvmalloc() with kvmalloc()")
>     Signed-off-by: Jan Dakinevich <jan.dakinevich at virtuozzo.com>
> ---
>  fs/ext4/super.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 94c904f72af6..16a69d853c28 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -2192,7 +2192,7 @@ int ext4_alloc_group_desc_bh_array(struct super_block *sb, ext4_group_t ngroup)
>  	}
>
>  	memcpy(n_group_desc, sbi->s_group_desc,
> -	       num_desc * sizeof(struct buffer_head *));
> +	       sbi->s_gdb_count * sizeof(struct buffer_head *));
>  	kvfree(sbi->s_group_desc);
>
>  	sbi->s_group_desc = n_group_desc;
> .
>