Patch "ext4: reject inodes with negative size" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

ext4: reject inodes with negative size

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ext4-reject-inodes-with-negative-size.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Darrick J. Wong" <[email protected]>
Date: Sat, 10 Dec 2016 09:55:01 -0500
Subject: ext4: reject inodes with negative size

From: Darrick J. Wong <[email protected]>

commit 7e6e1ef48fc02f3ac5d0edecbb0c6087cd758d58 upstream.

Don't load an inode with a negative size; this causes integer overflow problems in the VFS.

[ Added EXT4_ERROR_INODE() to mark file system as corrupted. -TYT]

---
 fs/ext4/inode.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -4175,6 +4175,7 @@ struct inode *ext4_iget(struct super_blo
 	struct inode *inode;
 	journal_t *journal = EXT4_SB(sb)->s_journal;
 	long ret;
+	loff_t size;
 	int block;
 	uid_t i_uid;
 	gid_t i_gid;

@@ -4266,6 +4267,11 @@ struct inode *ext4_iget(struct super_blo
 		ei->i_file_acl |=
 			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
 	inode->i_size = ext4_isize(raw_inode);
+	if ((size = i_size_read(inode)) < 0) {
+		EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size);
+		ret = -EFSCORRUPTED;
+		goto bad_inode;
+	}
 	ei->i_disksize = inode->i_size;
 #ifdef CONFIG_QUOTA
 	ei->i_reserved_quota = 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ext4-reject-inodes-with-negative-size.patch