lkml.org 
[lkml]   [2017]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 090/113] ext4: validate s_first_meta_bg at mount time
    Date
    From: Eryu Guan <guaneryu@gmail.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.

    Ralf Spenneberg reported that he hit a kernel crash when mounting a
    modified ext4 image. And it turns out that kernel crashed when
    calculating fs overhead (ext4_calculate_overhead()), this is because
    the image has very large s_first_meta_bg (debug code shows it's
    842150400), and ext4 overruns the memory in count_overhead() when
    setting bitmap buffer, which is PAGE_SIZE.

    ext4_calculate_overhead():
    buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer
    blks = count_overhead(sb, i, buf);

    count_overhead():
    for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
    ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun
    count++;
    }

    This can be reproduced easily for me by this script:

    #!/bin/bash
    rm -f fs.img
    mkdir -p /mnt/ext4
    fallocate -l 16M fs.img
    mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
    debugfs -w -R "ssv first_meta_bg 842150400" fs.img
    mount -o loop fs.img /mnt/ext4

    Fix it by validating s_first_meta_bg first at mount time, and
    refusing to mount if its value exceeds the largest possible meta_bg
    number.

    [js] use EXT4_HAS_INCOMPAT_FEATURE instead of new
    ext4_has_feature_meta_bg

    Reported-by: Ralf Spenneberg <ralf@os-t.de>
    Signed-off-by: Eryu Guan <guaneryu@gmail.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Reviewed-by: Andreas Dilger <adilger@dilger.ca>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    fs/ext4/super.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    index 6362896f5875..a263fa90edfa 100644
    --- a/fs/ext4/super.c
    +++ b/fs/ext4/super.c
    @@ -3852,6 +3852,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
    (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
    db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
    EXT4_DESC_PER_BLOCK(sb);
    + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG)) {
    + if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
    + ext4_msg(sb, KERN_WARNING,
    + "first meta block group too large: %u "
    + "(group descriptor block count %u)",
    + le32_to_cpu(es->s_first_meta_bg), db_count);
    + goto failed_mount;
    + }
    + }
    sbi->s_group_desc = ext4_kvmalloc(db_count *
    sizeof(struct buffer_head *),
    GFP_KERNEL);
    --
    2.12.0
    \
     
     \ /
      Last update: 2017-03-06 10:21    [W:4.236 / U:0.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site