Patch "ext4: fix crash when a directory's i_size is too small" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

ext4: fix crash when a directory's i_size is too small

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ext4-fix-crash-when-a-directory-s-i_size-is-too-small.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Chandan Rajendra <[email protected]>
Date: Mon, 11 Dec 2017 15:00:57 -0500
Subject: ext4: fix crash when a directory's i_size is too small

From: Chandan Rajendra <[email protected]>

commit 9d5afec6b8bd46d6ed821aa1579634437f58ef1f upstream.

On a ppc64 machine, when mounting a fuzzed ext2 image (generated by fsfuzzer) the following call trace is seen,

VFS: brelse: Trying to free free buffer

WARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40
.__brelse.part.6+0x20/0x40 (unreliable)
.ext4_find_entry+0x384/0x4f0
.ext4_lookup+0x84/0x250
.lookup_slow+0xdc/0x230
.walk_component+0x268/0x400
.path_lookupat+0xec/0x2d0
.filename_lookup+0x9c/0x1d0
.vfs_statx+0x98/0x140
.SyS_newfstatat+0x48/0x80
system_call+0x58/0x6c

This happens because the directory that ext4_find_entry() looks up has inode->i_size that is less than the block size of the filesystem. This causes 'nblocks' to have a value of zero. ext4_bread_batch() ends up not reading any of the directory file's blocks. This renders the entries in bh_use[] array to continue to have garbage data. buffer_uptodate() on bh_use[0] can then return a zero value upon which brelse() function is invoked.

This commit fixes the bug by returning -ENOENT when the directory file has no associated blocks.

---
 fs/ext4/namei.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1399,6 +1399,10 @@ static struct buffer_head * ext4_find_en
 			       "falling back\n"));
 	}
 	nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
+	if (!nblocks) {
+		ret = NULL;
+		goto cleanup_and_exit;
+	}
 	start = EXT4_I(dir)->i_dir_start_lookup;
 	if (start >= nblocks)
 		start = 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/ext4-fix-crash-when-a-directory-s-i_size-is-too-small.patch