[Devel] [PATCH RHEL7 COMMIT] ms/ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1160.31.1.vz7.181.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.31.1.vz7.181.4
------>
commit a4b0543d5ece654bd4ff594fcd1757493ecbde9a
Author: Harshad Shirwadkar <harshadshirwadkar at gmail.com>
Date:   Fri Jun 18 16:08:09 2021 +0300

    ms/ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
    
    ms commit c36a71b4e35a
    
    If eh->eh_max is 0, EXT_MAX_EXTENT/INDEX would evaluate to unsigned
    (-1) resulting in illegal memory accesses. Although there is no
    consistent repro, we see that generic/019 sometimes crashes because of
    this bug.
    
    Ran gce-xfstests smoke and verified that there were no regressions.
    
    Signed-off-by: Harshad Shirwadkar <harshadshirwadkar at gmail.com>
    Link: https://lore.kernel.org/r/20200421023959.20879-2-harshadshirwadkar@gmail.com
    Signed-off-by: Theodore Ts'o <tytso at mit.edu>
    Cc: stable at kernel.org
    
    https://jira.sw.ru/browse/PSBM-129846
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 fs/ext4/ext4_extents.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 01e72cb..dc2bc94 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -168,10 +168,13 @@ struct ext4_ext_path {
 	(EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
 #define EXT_LAST_INDEX(__hdr__) \
 	(EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
-#define EXT_MAX_EXTENT(__hdr__) \
-	(EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
+#define EXT_MAX_EXTENT(__hdr__)	\
+	((le16_to_cpu((__hdr__)->eh_max)) ? \
+	((EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) \
+					: 0)
 #define EXT_MAX_INDEX(__hdr__) \
-	(EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
+	((le16_to_cpu((__hdr__)->eh_max)) ? \
+	((EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) : 0)
 
 static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode)
 {