Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1551423

[PATCH 4.4 35/60] ext4: fix in-superblock mount options processing

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 5aee0f8a3f42c94c5012f1673420aee96315925a upstream.

Fix a large number of problems with how we handle mount options in the
superblock.  For one, if the string in the superblock is long enough
that it is not null terminated, we could run off the end of the string
and try to interpret superblocks fields as characters.  It's unlikely
this will cause a security problem, but it could result in an invalid
parse.  Also, parse_options is destructive to the string, so in some
cases if there is a comma-separated string, it would be modified in
the superblock.  (Fortunately it only happens on file systems with a
1k block size.)

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |   38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3130,7 +3130,7 @@ static int ext4_fill_super(struct super_
 	char *orig_data = kstrdup(data, GFP_KERNEL);
 	struct buffer_head *bh;
 	struct ext4_super_block *es = NULL;
-	struct ext4_sb_info *sbi;
+	struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
 	ext4_fsblk_t block;
 	ext4_fsblk_t sb_block = get_sb_block(&data);
 	ext4_fsblk_t logical_sb_block;
@@ -3149,16 +3149,14 @@ static int ext4_fill_super(struct super_
 	unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO;
 	ext4_group_t first_not_zeroed;
 
-	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
-	if (!sbi)
-		goto out_free_orig;
+	if ((data && !orig_data) || !sbi)
+		goto out_free_base;
 
 	sbi->s_blockgroup_lock =
 		kzalloc(sizeof(struct blockgroup_lock), GFP_KERNEL);
-	if (!sbi->s_blockgroup_lock) {
-		kfree(sbi);
-		goto out_free_orig;
-	}
+	if (!sbi->s_blockgroup_lock)
+		goto out_free_base;
+
 	sb->s_fs_info = sbi;
 	sbi->s_sb = sb;
 	sbi->s_inode_readahead_blks = EXT4_DEF_INODE_READAHEAD_BLKS;
@@ -3304,11 +3302,19 @@ static int ext4_fill_super(struct super_
 	 */
 	sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;
 
-	if (!parse_options((char *) sbi->s_es->s_mount_opts, sb,
-			   &journal_devnum, &journal_ioprio, 0)) {
-		ext4_msg(sb, KERN_WARNING,
-			 "failed to parse options in superblock: %s",
-			 sbi->s_es->s_mount_opts);
+	if (sbi->s_es->s_mount_opts[0]) {
+		char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts,
+					      sizeof(sbi->s_es->s_mount_opts),
+					      GFP_KERNEL);
+		if (!s_mount_opts)
+			goto failed_mount;
+		if (!parse_options(s_mount_opts, sb, &journal_devnum,
+				   &journal_ioprio, 0)) {
+			ext4_msg(sb, KERN_WARNING,
+				 "failed to parse options in superblock: %s",
+				 s_mount_opts);
+		}
+		kfree(s_mount_opts);
 	}
 	sbi->s_def_mount_opt = sbi->s_mount_opt;
 	if (!parse_options((char *) data, sb, &journal_devnum,
@@ -3991,7 +3997,9 @@ no_journal:
 
 	if (___ratelimit(&ext4_mount_msg_ratelimit, "EXT4-fs mount"))
 		ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. "
-			 "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts,
+			 "Opts: %.*s%s%s", descr,
+			 (int) sizeof(sbi->s_es->s_mount_opts),
+			 sbi->s_es->s_mount_opts,
 			 *sbi->s_es->s_mount_opts ? "; " : "", orig_data);
 
 	if (es->s_error_count)
@@ -4061,8 +4069,8 @@ failed_mount:
 out_fail:
 	sb->s_fs_info = NULL;
 	kfree(sbi->s_blockgroup_lock);
+out_free_base:
 	kfree(sbi);
-out_free_orig:
 	kfree(orig_data);
 	return err ? err : ret;
 }

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/60] 4.4.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:30 +0100
  [PATCH 4.4 47/60] dm flakey: return -EINVAL on interval bounds error in flakey_ctr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:30 +0100
  [PATCH 4.4 07/60] USB: serial: kl5kusb105: fix open error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 34/60] ext4: use more strict checks for inodes_per_block on mount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 33/60] ext4: fix stack memory corruption with 64k block size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 36/60] ext4: add sanity checking to count_overhead() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 30/60] ptrace: Capture the ptracers creds not PT_PTRACE_CAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 18/60] ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 03/60] btrfs: store and load values of stripes_min/stripes_max in balance status item Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 21/60] Btrfs: fix memory leak in reading btree blocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 06/60] USB: serial: option: add dlink dwm-158 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 05/60] USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 08/60] USB: cdc-acm: add device id for GW Instek AFG-125 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 32/60] ext4: fix mballoc breakage with 64k block size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 04/60] Btrfs: fix qgroup rescan worker initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 09/60] usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 35/60] ext4: fix in-superblock mount options processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:40 +0100
  [PATCH 4.4 15/60] ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:50 +0100
  [PATCH 4.4 13/60] ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 22:50 +0100
  Re: [PATCH 4.4 00/60] 4.4.40-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-05 01:50 +0100
  Re: [PATCH 4.4 00/60] 4.4.40-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-05 06:30 +0100
  Re: [PATCH 4.4 00/60] 4.4.40-stable review Guillaume Nault <g.nault@alphalink.fr> - 2017-01-05 16:50 +0100
    Re: [PATCH 4.4 00/60] 4.4.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-05 21:40 +0100

csiph-web