[PATCH 1/6] fs: ext4: refuse to write with an unexpected first data block

[Ana Bobillo <anabobillo3@gmail.com>]

From: Ana Bobillo <anabobillo3@gmail.com>

ext4fs_blk_to_group() computes the block group of a block from
s_first_data_block, as Linux does. The rest of the write path takes the
first data block to be block 1 with 1 KiB blocks and block 0 otherwise,
which is what mke2fs makes: ext4fs_set_block_bmap() and
ext4fs_reset_block_bmap() find the bit of a block from the block number
alone, _get_new_blk_no() numbers the blocks of a group the same way, and
ext4fs_init() reads the group descriptor table from the block after it.

With any other s_first_data_block the two disagree, and the delete path
clears the bit of a block in the bitmap of another group. With 4 KiB
blocks and a first data block of 1, for example, block 32768 is in
group 0 for ext4fs_blk_to_group(), and ext4fs_reset_block_bmap() then
reads the byte just past the end of group 0's bitmap buffer and clears
a bit of it.

Add the first data block to the layout check of ext4fs_init(), so that
the write path refuses a filesystem whose first data block is not the
one it assumes, as it refuses other layouts its bitmap code cannot
handle. Linux refuses a first data block of 0 with 1 KiB blocks too,
unless clusters are larger.

Signed-off-by: Ana Bobillo <anabobillo3@gmail.com>
---
 fs/ext4/ext4_write.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/ext4_write.c b/fs/ext4/ext4_write.c
index 0cbbdc6c934..11d9957de11 100644
--- a/fs/ext4/ext4_write.c
+++ b/fs/ext4/ext4_write.c
@@ -617,6 +617,7 @@ int ext4fs_init(void)
 	struct ext2_sblock *sblock = &ext4fs_root->sblock;
 	uint32_t blk_per_grp = le32_to_cpu(sblock->blocks_per_group);
 	uint32_t inode_per_grp = le32_to_cpu(sblock->inodes_per_group);
+	uint32_t first_data_block = le32_to_cpu(sblock->first_data_block);
 
 	/* populate fs */
 	fs->blksz = EXT2_BLOCK_SIZE(ext4fs_root);
@@ -625,14 +626,20 @@ int ext4fs_init(void)
 	/*
 	 * The bitmap code finds the bitmap bits of group n at n * blocksize
 	 * bytes, so every group must hold one bitmap block's worth of
-	 * blocks, unless there is only one group. Check this before the
+	 * blocks, unless there is only one group. It also takes the first
+	 * data block, which holds the superblock, to be block 1 with 1 KiB
+	 * blocks and block 0 otherwise, as mke2fs makes it, and so does the
+	 * write path when it finds the group descriptor table; with any
+	 * other first data block, ext4fs_blk_to_group() puts a block in
+	 * another group than the bitmap code does. Check this before the
 	 * journal is replayed, so that nothing is written to a filesystem
 	 * that is refused.
 	 */
 	if (!blk_per_grp || blk_per_grp > fs->blksz * 8 ||
 	    (blk_per_grp != fs->blksz * 8 &&
-	     le32_to_cpu(sblock->total_blocks) -
-	     le32_to_cpu(sblock->first_data_block) > blk_per_grp) ||
+	     le32_to_cpu(sblock->total_blocks) - first_data_block >
+	     blk_per_grp) ||
+	    first_data_block != (fs->blksz == EXT2_MIN_BLOCK_SIZE) ||
 	    !inode_per_grp || inode_per_grp > fs->blksz * 8) {
 		printf("Unsupported block group layout, not writing\n");
 		return -EINVAL;