Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1575735
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 02/66] ext4: validate s_first_meta_bg at mount time |
| Date | 2017-02-07 14:20 +0100 |
| Message-ID | <t8dQD-3lb-41@gated-at.bofh.it> (permalink) |
| References | <t8dxf-2Y8-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryu Guan <guaneryu@gmail.com>
commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.
Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.
ext4_calculate_overhead():
buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer
blks = count_overhead(sb, i, buf);
count_overhead():
for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun
count++;
}
This can be reproduced easily for me by this script:
#!/bin/bash
rm -f fs.img
mkdir -p /mnt/ext4
fallocate -l 16M fs.img
mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
debugfs -w -R "ssv first_meta_bg 842150400" fs.img
mount -o loop fs.img /mnt/ext4
Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.
Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3827,6 +3827,15 @@ static int ext4_fill_super(struct super_
(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
EXT4_DESC_PER_BLOCK(sb);
+ if (ext4_has_feature_meta_bg(sb)) {
+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+ ext4_msg(sb, KERN_WARNING,
+ "first meta block group too large: %u "
+ "(group descriptor block count %u)",
+ le32_to_cpu(es->s_first_meta_bg), db_count);
+ goto failed_mount;
+ }
+ }
sbi->s_group_desc = ext4_kvmalloc(db_count *
sizeof(struct buffer_head *),
GFP_KERNEL);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/66] 4.9.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
[PATCH 4.9 01/66] PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
[PATCH 4.9 50/66] USB: serial: qcserial: add Dell DW5570 QDL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 45/66] HID: wacom: Fix poor prox handling in wacom_pl_irq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 58/66] iio: health: afe4404: retrieve a valid iio_dev in suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 40/66] pinctrl: intel: merrifield: Add missed check in mrfld_config_set() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 59/66] iio: health: afe4403: retrieve a valid iio_dev in suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 25/66] zswap: disable changing params if init fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 05/66] xtensa: fix noMMU build on cores with MMU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 24/66] svcrpc: fix oops in absence of krb5 module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 63/66] x86/irq: Make irq activate operations symmetric Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 47/66] dmaengine: cppi41: Fix runtime PM timeouts with USB mass storage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 07/66] HID: cp2112: fix gpio-callback error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 62/66] irqdomain: Avoid activating interrupts more than once Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 48/66] dmaengine: cppi41: Fix oops in cppi41_runtime_resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 66/66] drm/i915/execlists: Reset RING registers upon resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 20/66] powerpc: Add missing error check to prom_find_boot_cpu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 21/66] powerpc: Fix build failure with clang due to BUILD_BUG_ON() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 65/66] fs: break out of iomap_file_buffered_write on fatal signals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 42/66] iwlwifi: mvm: avoid crash on restart w/o reserved queues Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 28/66] base/memory, hotplug: fix a kernel oops in show_valid_zones() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 61/66] iio: health: max30100: fixed parenthesis around FIFO count check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 64/66] iw_cxgb4: set correct FetchBurstMax for QPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 57/66] iio: adc: palmas_gpadc: retrieve a valid iio_dev in suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 54/66] usb: gadget: f_fs: Assorted buffer overflow checks. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 60/66] iio: dht11: Use usleep_range instead of msleep for start signal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 32/66] cgroup: dont online subsystems before cgroup_name/path() are operational Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 12/66] crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 10/66] drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 30/66] tracing: Fix hwlat kthread migration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 39/66] pinctrl: baytrail: Debounce register is one per community Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 18/66] libata: Fix ATA request sense Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 15/66] perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 23/66] NFSD: Fix a null reference case in find_or_create_lock_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 56/66] staging: greybus: timesync: validate platform state callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 31/66] can: bcm: fix hrtimer/tasklet termination in bcm op removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 13/66] crypto: arm64/aes-blk - honour iv_out requirement in CBC and CTR modes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 29/66] mm, fs: check for fatal signals in do_generic_file_read() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 26/66] cifs: initialize file_info_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 44/66] HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 16/66] ata: sata_mv:- Handle return value of devm_ioremap. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 08/66] pinctrl: baytrail: Add missing spinlock usage in byt_gpio_irq_handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 19/66] powerpc/eeh: Fix wrong flag passed to eeh_unfreeze_pe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 35/66] regulator: axp20x: AXP806: Fix dcdcb being set instead of dcdce Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 27/66] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 38/66] Revert "vring: Force use of DMA API for ARM-based systems with legacy devices" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 51/66] USB: serial: pl2303: add ATEN device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 53/66] usb: musb: Fix host mode error -71 regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:10 +0100
[PATCH 4.9 33/66] mmc: sdhci: Ignore unexpected CARD_INT interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 06/66] HID: cp2112: fix sleep-while-atomic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 22/66] powerpc/mm: Use the correct pointer when setting a 2MB pte Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 04/66] efi/fdt: Avoid FDT manipulation after ExitBootServices() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 36/66] percpu-refcount: fix reference leak during percpu-atomic transition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 03/66] x86/efi: Always map the first physical page into the EFI pagetables Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 43/66] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 34/66] vhost: fix initialization for vq->is_le Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 46/66] perf/x86/intel/uncore: Clean up hotplug conversion fallout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 02/66] ext4: validate s_first_meta_bg at mount time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:20 +0100
[PATCH 4.9 14/66] perf/core: Fix use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:30 +0100
[PATCH 4.9 11/66] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:30 +0100
Re: [PATCH 4.9 00/66] 4.9.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-07 17:10 +0100
Re: [PATCH 4.9 00/66] 4.9.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 17:20 +0100
Re: [PATCH 4.9 00/66] 4.9.9-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-07 22:50 +0100
Re: [PATCH 4.9 00/66] 4.9.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 07:40 +0100
Re: [PATCH 4.9 00/66] 4.9.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 07:40 +0100
csiph-web