ext4: fix argument checking in EXT4_IOC_MOVE_EXT

If the starting block number of either the source or destination file
exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL.

Also fixed the helper function mext_check_coverage() so that if the
logical block is beyond EOF, make it return immediately, instead of
looping until the block number wraps all the away around.  This takes
long enough that if there are multiple threads trying to do pound on
an the same inode doing non-sensical things, it can end up triggering
the kernel's soft lockup detector.

Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index a409ff70d67ba7dd13b8e1c55ac9d29987b91c76..2f5be02fc6f6a2194f45adb5429f658c2d0a184a 100644 (file)
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -516,9 +516,13 @@ mext_check_arguments(struct inode *orig_inode,
                        orig_inode->i_ino, donor_inode->i_ino);
                return -EINVAL;
        }
-       if (orig_eof < orig_start + *len - 1)
+       if (orig_eof <= orig_start)
+               *len = 0;
+       else if (orig_eof < orig_start + *len - 1)
                *len = orig_eof - orig_start;
-       if (donor_eof < donor_start + *len - 1)
+       if (donor_eof <= donor_start)
+               *len = 0;
+       else if (donor_eof < donor_start + *len - 1)
                *len = donor_eof - donor_start;
        if (!*len) {
                ext4_debug("ext4 move extent: len should not be 0 "