DragonFlyBSD Kernel Audit
DF-3063 / fix.diff
← back to finding ↓ download raw
--- sys/vfs/ext2fs/ext2_alloc.c
+++ sys/vfs/ext2fs/ext2_alloc.c
@@ -1247,9 +1247,11 @@
 
 	if (le16toh(fs->e2fs_gd[cg].ext4bgd_flags) & EXT2_BG_INODE_ZEROED)
 		return (0);
 
-	all_blks = le16toh(fs->e2fs->e2fs_inode_size) * fs->e2fs_ipg /
-	    fs->e2fs_bsize;
-
+	/* DF-3063: use the validated in-memory inode size (e2fs_isize),
+	 * never the raw on-disk field: at REV0 s_inode_size is
+	 * unvalidated and inflated values drove getblk/bawrite zero-
+	 * fills far past the inode table. */
+	all_blks = fs->e2fs_isize * fs->e2fs_ipg / fs->e2fs_bsize;
 	used_blks = howmany(fs->e2fs_ipg -
 	    e2fs_gd_get_i_unused(&fs->e2fs_gd[cg]),