[SRU][O/N][PATCH 1/1] ext4: no need to continue when the number of entries is 1

[Koichiro Den]

From: Edward Adam Davis <eadavis at qq.com>

Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3")
Reported-by: syzbot+ae688d469e36fb5138d0 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae688d469e36fb5138d0
Signed-off-by: Edward Adam Davis <eadavis at qq.com>
Reported-and-tested-by: syzbot+ae688d469e36fb5138d0 at syzkaller.appspotmail.com
Link: https://patch.msgid.link/tencent_BE7AEE6C7C2D216CB8949CE8E6EE7ECC2C0A@qq.com
Signed-off-by: Theodore Ts'o <tytso at mit.edu>
Cc: stable at kernel.org
(cherry picked from commit 1a00a393d6a7fb1e745a41edd09019bd6a0ad64c)
CVE-2024-49967
Signed-off-by: Koichiro Den <koichiro.den at canonical.com>
---
 fs/ext4/namei.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6a95713f9193..1de1c1b460a7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1999,7 +1999,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
 		split = count/2;
 
 	hash2 = map[split].hash;
-	continued = hash2 == map[split - 1].hash;
+	continued = split > 0 ? hash2 == map[split - 1].hash : 0;
 	dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
 			(unsigned long)dx_get_block(frame->at),
 					hash2, split, count-split));
-- 
2.43.0