Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->s_blocksize. On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range. Reject ranges shorter than s_clustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
aa89762c54800208d5afdcd8e6bf124818f17fe0 to < d903d59c0315f59bdf0214b4f13d71c9feb2c45caffectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < 441abb77222f155e8d931dbabb465466db01cfd7affectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < e652d0f5108e447b22da4249bcd23dd1b63c73ddaffectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < 346314bb0cc2fc52b50b73d6ecc62e0217455c2eaffectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < 06c0a0431b9856506fcd9b2c1b0c6136567d756daffectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < 3fa7139b5f42731a61f78c42433adae13f9adc21affectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < 2c13e02592b918be7725ab5965e01ef4e46c4b57affectedaa89762c54800208d5afdcd8e6bf124818f17fe0 to < ca1afd88f5eaaff9168e1466e5401385edf59543affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c ↗
- https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7 ↗
- https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd ↗
- https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e ↗
- https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d ↗
- https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21 ↗
- https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57 ↗
- https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543 ↗