ext4: fix false negatives *and* false positives in ext4_check_descriptors() (Closes: #903838)

3 files changed, 60 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 0eceed954cc8..6b3b9da78f21 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+linux (4.17.6-3) UNRELEASED; urgency=medium
+
+  * ext4: fix false negatives *and* false positives in ext4_check_descriptors()
+    (Closes: #903838)
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Tue, 17 Jul 2018 17:53:41 +0100
+
 linux (4.17.6-2) unstable; urgency=medium
 
   [ Ben Hutchings ]
diff --git a/debian/patches/bugfix/all/ext4-fix-false-negatives-and-false-positives-in-ext4.patch b/debian/patches/bugfix/all/ext4-fix-false-negatives-and-false-positives-in-ext4.patch
new file mode 100644
index 000000000000..b6ae2e851b7f
--- /dev/null
+++ b/debian/patches/bugfix/all/ext4-fix-false-negatives-and-false-positives-in-ext4.patch
@@ -0,0 +1,52 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 8 Jul 2018 19:35:02 -0400
+Subject: ext4: fix false negatives *and* false positives in
+ ext4_check_descriptors()
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit?id=44de022c4382541cebdd6de4465d1f4f465ff1dd
+Bug-Debian: https://bugs.debian.org/903838
+
+Ext4_check_descriptors() was getting called before s_gdb_count was
+initialized.  So for file systems w/o the meta_bg feature, allocation
+bitmaps could overlap the block group descriptors and ext4 wouldn't
+notice.
+
+For file systems with the meta_bg feature enabled, there was a
+fencepost error which would cause the ext4_check_descriptors() to
+incorrectly believe that the block allocation bitmap overlaps with the
+block group descriptor blocks, and it would reject the mount.
+
+Fix both of these problems.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+---
+ fs/ext4/super.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2307,7 +2307,7 @@ static int ext4_check_descriptors(struct
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
+ 	ext4_fsblk_t last_block;
+-	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
++	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0);
+ 	ext4_fsblk_t block_bitmap;
+ 	ext4_fsblk_t inode_bitmap;
+ 	ext4_fsblk_t inode_table;
+@@ -4050,14 +4050,13 @@ static int ext4_fill_super(struct super_
+ 			goto failed_mount2;
+ 		}
+ 	}
++	sbi->s_gdb_count = db_count;
+ 	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
+ 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
+ 		ret = -EFSCORRUPTED;
+ 		goto failed_mount2;
+ 	}
+ 
+-	sbi->s_gdb_count = db_count;
+-
+ 	timer_setup(&sbi->s_err_report, print_daily_error_info, 0);
+ 
+ 	/* Register extent status tree shrinker */
diff --git a/debian/patches/series b/debian/patches/series
index 33de109fb631..cb0426ea88eb 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -139,6 +139,7 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
 debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 bugfix/all/jfs-fix-inconsistency-between-memory-allocation-and-.patch
 bugfix/all/fix-up-non-directory-creation-in-sgid-directories.patch
+bugfix/all/ext4-fix-false-negatives-and-false-positives-in-ext4.patch
 
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch