Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1575648

[PATCH 4.4 02/29] ext4: validate s_first_meta_bg at mount time

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eryu Guan <guaneryu@gmail.com>

commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.

Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.

ext4_calculate_overhead():
  buf = get_zeroed_page(GFP_NOFS);  <=== PAGE_SIZE buffer
  blks = count_overhead(sb, i, buf);

count_overhead():
  for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
          ext4_set_bit(EXT4_B2C(sbi, s++), buf);   <=== buffer overrun
          count++;
  }

This can be reproduced easily for me by this script:

  #!/bin/bash
  rm -f fs.img
  mkdir -p /mnt/ext4
  fallocate -l 16M fs.img
  mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
  debugfs -w -R "ssv first_meta_bg 842150400" fs.img
  mount -o loop fs.img /mnt/ext4

Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.

Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3663,6 +3663,15 @@ static int ext4_fill_super(struct super_
 			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
 		   EXT4_DESC_PER_BLOCK(sb);
+	if (ext4_has_feature_meta_bg(sb)) {
+		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+			ext4_msg(sb, KERN_WARNING,
+				 "first meta block group too large: %u "
+				 "(group descriptor block count %u)",
+				 le32_to_cpu(es->s_first_meta_bg), db_count);
+			goto failed_mount;
+		}
+	}
 	sbi->s_group_desc = ext4_kvmalloc(db_count *
 					  sizeof(struct buffer_head *),
 					  GFP_KERNEL);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 23/29] USB: serial: qcserial: add Dell DW5570 QDL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 13/29] svcrpc: fix oops in absence of krb5 module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 07/29] perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 29/29] base/memory, hotplug: fix a kernel oops in show_valid_zones() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 20/29] percpu-refcount: fix reference leak during percpu-atomic transition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 18/29] can: bcm: fix hrtimer/tasklet termination in bcm op removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 24/29] USB: serial: pl2303: add ATEN device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 08/29] ata: sata_mv:- Handle return value of devm_ioremap. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 11/29] powerpc: Add missing error check to prom_find_boot_cpu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 21/29] HID: wacom: Fix poor prox handling in wacom_pl_irq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 03/29] drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 28/29] x86/irq: Make irq activate operations symmetric Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 02/29] ext4: validate s_first_meta_bg at mount time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 15/29] cifs: initialize file_info_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 26/29] usb: gadget: f_fs: Assorted buffer overflow checks. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 04/29] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 13:50 +0100
  [PATCH 4.4 01/29] PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 14/29] zswap: disable changing params if init fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 16/29] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 12/29] NFSD: Fix a null reference case in find_or_create_lock_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  [PATCH 4.4 19/29] mmc: sdhci: Ignore unexpected CARD_INT interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-07 14:00 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-07 17:00 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-07 22:50 +0100
  Re: [PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 07:40 +0100
    Re: [PATCH 4.4 00/29] 4.4.48-stable review Kevin Hilman <khilman@baylibre.com> - 2017-02-08 20:50 +0100
      Re: [PATCH 4.4 00/29] 4.4.48-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-08 21:10 +0100

csiph-web