mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-10 16:34:22 -05:00
68 lines
2.3 KiB
Diff
68 lines
2.3 KiB
Diff
|
From 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Mon Sep 17 00:00:00 2001
|
||
|
From: Eryu Guan <guaneryu@gmail.com>
|
||
|
Date: Thu, 1 Dec 2016 15:08:37 -0500
|
||
|
Subject: ext4: validate s_first_meta_bg at mount time
|
||
|
|
||
|
Ralf Spenneberg reported that he hit a kernel crash when mounting a
|
||
|
modified ext4 image. And it turns out that kernel crashed when
|
||
|
calculating fs overhead (ext4_calculate_overhead()), this is because
|
||
|
the image has very large s_first_meta_bg (debug code shows it's
|
||
|
842150400), and ext4 overruns the memory in count_overhead() when
|
||
|
setting bitmap buffer, which is PAGE_SIZE.
|
||
|
|
||
|
ext4_calculate_overhead():
|
||
|
buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer
|
||
|
blks = count_overhead(sb, i, buf);
|
||
|
|
||
|
count_overhead():
|
||
|
for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
|
||
|
ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun
|
||
|
count++;
|
||
|
}
|
||
|
|
||
|
This can be reproduced easily for me by this script:
|
||
|
|
||
|
#!/bin/bash
|
||
|
rm -f fs.img
|
||
|
mkdir -p /mnt/ext4
|
||
|
fallocate -l 16M fs.img
|
||
|
mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
|
||
|
debugfs -w -R "ssv first_meta_bg 842150400" fs.img
|
||
|
mount -o loop fs.img /mnt/ext4
|
||
|
|
||
|
Fix it by validating s_first_meta_bg first at mount time, and
|
||
|
refusing to mount if its value exceeds the largest possible meta_bg
|
||
|
number.
|
||
|
|
||
|
Reported-by: Ralf Spenneberg <ralf@os-t.de>
|
||
|
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
|
||
|
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||
|
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
|
||
|
---
|
||
|
fs/ext4/super.c | 9 +++++++++
|
||
|
1 file changed, 9 insertions(+)
|
||
|
|
||
|
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
|
||
|
index a526956..32c0deb 100644
|
||
|
--- a/fs/ext4/super.c
|
||
|
+++ b/fs/ext4/super.c
|
||
|
@@ -3842,6 +3842,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
|
||
|
(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
|
||
|
db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
|
||
|
EXT4_DESC_PER_BLOCK(sb);
|
||
|
+ if (ext4_has_feature_meta_bg(sb)) {
|
||
|
+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
|
||
|
+ ext4_msg(sb, KERN_WARNING,
|
||
|
+ "first meta block group too large: %u "
|
||
|
+ "(group descriptor block count %u)",
|
||
|
+ le32_to_cpu(es->s_first_meta_bg), db_count);
|
||
|
+ goto failed_mount;
|
||
|
+ }
|
||
|
+ }
|
||
|
sbi->s_group_desc = ext4_kvmalloc(db_count *
|
||
|
sizeof(struct buffer_head *),
|
||
|
GFP_KERNEL);
|
||
|
--
|
||
|
cgit v1.1
|
||
|
|