lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 041/287] ext2: Add more validity checks for inode counts
    Date
    From: Jan Kara <jack@suse.cz>

    [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ]

    Add checks verifying number of inodes stored in the superblock matches
    the number computed from number of inodes per group. Also verify we have
    at least one block worth of inodes per group. This prevents crashes on
    corrupted filesystems.

    Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ext2/super.c | 12 ++++++++++--
    1 file changed, 10 insertions(+), 2 deletions(-)

    diff --git a/fs/ext2/super.c b/fs/ext2/super.c
    index ad9fd08f66ba..44a1f356aca2 100644
    --- a/fs/ext2/super.c
    +++ b/fs/ext2/super.c
    @@ -1088,9 +1088,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
    sbi->s_frags_per_group);
    goto failed_mount;
    }
    - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {
    + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
    + sbi->s_inodes_per_group > sb->s_blocksize * 8) {
    ext2_msg(sb, KERN_ERR,
    - "error: #inodes per group too big: %lu",
    + "error: invalid #inodes per group: %lu",
    sbi->s_inodes_per_group);
    goto failed_mount;
    }
    @@ -1100,6 +1101,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
    sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
    le32_to_cpu(es->s_first_data_block) - 1)
    / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
    + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=
    + le32_to_cpu(es->s_inodes_count)) {
    + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",
    + le32_to_cpu(es->s_inodes_count),
    + (u64)sbi->s_groups_count * sbi->s_inodes_per_group);
    + goto failed_mount;
    + }
    db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
    EXT2_DESC_PER_BLOCK(sb);
    sbi->s_group_desc = kmalloc_array (db_count,
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 12:37    [W:4.171 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site