diff options
author | Eryu Guan <guaneryu@gmail.com> | 2016-12-01 15:08:37 -0500 |
---|---|---|
committer | Andreas Blaesius <skate4life@gmx.de> | 2017-05-17 19:25:37 +0200 |
commit | f7ec89378117b946671934c0f481e414a3b4e811 (patch) | |
tree | ba231d47bf439140993d933a1722883f86d31936 /fs/dcookies.c | |
parent | 2f2242ea20d7f4e3b0d8247f2a5be2b0feb37262 (diff) | |
download | kernel_samsung_tuna-f7ec89378117b946671934c0f481e414a3b4e811.tar.gz kernel_samsung_tuna-f7ec89378117b946671934c0f481e414a3b4e811.tar.bz2 kernel_samsung_tuna-f7ec89378117b946671934c0f481e414a3b4e811.zip |
ext4: validate s_first_meta_bg at mount time
Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.
ext4_calculate_overhead():
buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer
blks = count_overhead(sb, i, buf);
count_overhead():
for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun
count++;
}
This can be reproduced easily for me by this script:
#!/bin/bash
rm -f fs.img
mkdir -p /mnt/ext4
fallocate -l 16M fs.img
mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
debugfs -w -R "ssv first_meta_bg 842150400" fs.img
mount -o loop fs.img /mnt/ext4
Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.
Change-Id: If8f0dbed1ed36f3ef9b4466feb4245d8ba5c89b6
Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Diffstat (limited to 'fs/dcookies.c')
0 files changed, 0 insertions, 0 deletions