aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorEryu Guan <guaneryu@gmail.com>2016-12-01 15:08:37 -0500
committerAndreas Blaesius <skate4life@gmx.de>2017-03-17 11:02:39 +0100
commit50821a944cf58e50039b0dc810e73b95cef986d8 (patch)
tree55af62cf73f9ac07e731f94d5ecc400104bcb0c2 /fs
parent1f9eb2433caed2e586fd759ad722db15f0ef305a (diff)
downloadkernel_samsung_espresso10-50821a944cf58e50039b0dc810e73b95cef986d8.zip
kernel_samsung_espresso10-50821a944cf58e50039b0dc810e73b95cef986d8.tar.gz
kernel_samsung_espresso10-50821a944cf58e50039b0dc810e73b95cef986d8.tar.bz2
ext4: validate s_first_meta_bg at mount time
Ralf Spenneberg reported that he hit a kernel crash when mounting a modified ext4 image. And it turns out that kernel crashed when calculating fs overhead (ext4_calculate_overhead()), this is because the image has very large s_first_meta_bg (debug code shows it's 842150400), and ext4 overruns the memory in count_overhead() when setting bitmap buffer, which is PAGE_SIZE. ext4_calculate_overhead(): buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer blks = count_overhead(sb, i, buf); count_overhead(): for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400 ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun count++; } This can be reproduced easily for me by this script: #!/bin/bash rm -f fs.img mkdir -p /mnt/ext4 fallocate -l 16M fs.img mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img debugfs -w -R "ssv first_meta_bg 842150400" fs.img mount -o loop fs.img /mnt/ext4 Fix it by validating s_first_meta_bg first at mount time, and refusing to mount if its value exceeds the largest possible meta_bg number. Change-Id: If8f0dbed1ed36f3ef9b4466feb4245d8ba5c89b6 Reported-by: Ralf Spenneberg <ralf@os-t.de> Signed-off-by: Eryu Guan <guaneryu@gmail.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/super.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index e05cd34..e2725f0 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3409,6 +3409,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
EXT4_DESC_PER_BLOCK(sb);
+ if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+ ext4_msg(sb, KERN_WARNING,
+ "first meta block group too large: %u "
+ "(group descriptor block count %u)",
+ le32_to_cpu(es->s_first_meta_bg), db_count);
+ goto failed_mount;
+ }
+ }
sbi->s_group_desc = kmalloc(db_count * sizeof(struct buffer_head *),
GFP_KERNEL);
if (sbi->s_group_desc == NULL) {