mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
ext4: fix oops on corrupted ext4 mount
When mounting an ext4 filesystem with corrupted s_first_data_block, things can go very wrong and oops. Because blocks_count in ext4_fill_super is a u64, and we must use do_div, the calculation of db_count is done differently than on ext4. If first_data_block is corrupted such that it is larger than ext4_blocks_count, for example, then the intermediate blocks_count value may go negative, but sign-extend to a very large value: blocks_count = (ext4_blocks_count(es) - le32_to_cpu(es->s_first_data_block) + EXT4_BLOCKS_PER_GROUP(sb) - 1); This is then assigned to s_groups_count which is an unsigned long: sbi->s_groups_count = blocks_count; This may result in a value of 0xFFFFFFFF which is then used to compute db_count: db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / EXT4_DESC_PER_BLOCK(sb); and in this case db_count will wind up as 0 because the addition overflows 32 bits. This in turn causes the kmalloc for group_desc to be of 0 size: sbi->s_group_desc = kmalloc(db_count * sizeof (struct buffer_head *), GFP_KERNEL); and eventually in ext4_check_descriptors, dereferencing sbi->s_group_desc[desc_block] will result in a NULL pointer dereference. The simplest test seems to be to sanity check s_first_data_block, EXT4_BLOCKS_PER_GROUP, and ext4_blocks_count values to be sure their combination won't result in a bad intermediate value for blocks_count. We could just check for db_count == 0, but catching it at the root cause seems like it provides more info. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Mingming Cao <cmm@us.ibm.com>
This commit is contained in:
parent
07620f69ef
commit
e7c9559300
1 changed files with 11 additions and 0 deletions
|
@ -1997,6 +1997,17 @@ static int ext4_fill_super (struct super_block *sb, void *data, int silent)
|
||||||
|
|
||||||
if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
|
if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
|
||||||
goto cantfind_ext4;
|
goto cantfind_ext4;
|
||||||
|
|
||||||
|
/* ensure blocks_count calculation below doesn't sign-extend */
|
||||||
|
if (ext4_blocks_count(es) + EXT4_BLOCKS_PER_GROUP(sb) <
|
||||||
|
le32_to_cpu(es->s_first_data_block) + 1) {
|
||||||
|
printk(KERN_WARNING "EXT4-fs: bad geometry: block count %llu, "
|
||||||
|
"first data block %u, blocks per group %lu\n",
|
||||||
|
ext4_blocks_count(es),
|
||||||
|
le32_to_cpu(es->s_first_data_block),
|
||||||
|
EXT4_BLOCKS_PER_GROUP(sb));
|
||||||
|
goto failed_mount;
|
||||||
|
}
|
||||||
blocks_count = (ext4_blocks_count(es) -
|
blocks_count = (ext4_blocks_count(es) -
|
||||||
le32_to_cpu(es->s_first_data_block) +
|
le32_to_cpu(es->s_first_data_block) +
|
||||||
EXT4_BLOCKS_PER_GROUP(sb) - 1);
|
EXT4_BLOCKS_PER_GROUP(sb) - 1);
|
||||||
|
|
Loading…
Reference in a new issue