ext4: fix spectre gadget in ext4_mb_regular_allocator()

[mirror_ubuntu-bionic-kernel.git] / fs / ext4 / mballoc.c

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index d9f8b90a93edcb2a685375479c9227ed99463003..1413e9513b615f9e0c692a8b21069ba93cdff137 100644 (file)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -26,6 +26,7 @@
 #include <linux/log2.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 #include <linux/backing-dev.h>
 #include <trace/events/ext4.h>
 
@@ -2152,7 +2153,8 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
                 * This should tell if fe_len is exactly power of 2
                 */
                if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0)
-                       ac->ac_2order = i - 1;
+                       ac->ac_2order = array_index_nospec(i - 1,
+                                                          sb->s_blocksize_bits + 2);
        }
 
        /* if stream allocation is enabled, use global goal */
@@ -2456,7 +2458,8 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
         * initialize bb_free to be able to skip
         * empty groups without initialization
         */
-       if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+       if (ext4_has_group_desc_csum(sb) &&
+           (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
                meta_group_info[i]->bb_free =
                        ext4_free_clusters_after_init(sb, group, desc);
        } else {
@@ -3023,7 +3026,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
 #endif
        ext4_set_bits(bitmap_bh->b_data, ac->ac_b_ex.fe_start,
                      ac->ac_b_ex.fe_len);
-       if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+       if (ext4_has_group_desc_csum(sb) &&
+           (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
                gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
                ext4_free_group_clusters_set(sb, gdp,
                                             ext4_free_clusters_after_init(sb,