if split is too small, such as 0, use it to calculate continued will out of bound map
#syz test: upstream 55027e689933
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a630b27a4cc6..0a111274dc4a 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2043,7 +2043,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
split = count/2;
hash2 = map[split].hash;
- continued = hash2 == map[split - 1].hash;
+ continued = split > 0 ? hash2 == map[split - 1].hash : 0;
dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
(unsigned long)dx_get_block(frame->at),
hash2, split, count-split));
Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+ae688d469e36fb5138d0@syzkaller.appspotmail.com Tested on: commit: 55027e68 Merge tag 'input-for-v6.10-rc5' of git://git... git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=16bb8761980000 kernel config: https://syzkaller.appspot.com/x/.config?x=67463c0717b8d4ca dashboard link: https://syzkaller.appspot.com/bug?extid=ae688d469e36fb5138d0 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=10754c81980000 Note: testing is done by a robot and is best-effort only.
© 2016 - 2025 Red Hat, Inc.