From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 517DAC25B0C for ; Mon, 8 Aug 2022 01:42:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242515AbiHHBmF (ORCPT ); Sun, 7 Aug 2022 21:42:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242656AbiHHBkN (ORCPT ); Sun, 7 Aug 2022 21:40:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB73AB7FD; Sun, 7 Aug 2022 18:34:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F093E60DDC; Mon, 8 Aug 2022 01:34:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9972DC43144; Mon, 8 Aug 2022 01:34:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1659922481; bh=Ll3VrOpxsVmeadqheby9L6HRHAFePhaWMYtkUoqpQtY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pyNwQx6u08sfUy0BOtzpE0VNysnKyCMKfqp8F063p7cdRt4lWt3Q/FTv8iJBkMIAB rnej5jU8OH3x6b4H0iR/oHnaygBchvoUcOimi2VqysPEEoEObWLnHVE6TZzv8DM9oR tYs0kq/nI3OQH8RIlPIupsZgLckIlUUGV0adzI6mDHw37q0OR2eCzlmrTx8OpFjd05 CJ6vRwGv4RhyCQnLNyFQDPOCTmsF2RDfN53dz6C6aUbNsX2I9yFUD+ahFGLaoaAeSA OQF8fPtzJS1+6IpMV7PaEQziZLwob8MhBUzKIu+Y2Zz1n1JceUgFG8h/nx2WGtSucC eunQaJ5osqm6w== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jan Kara , syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com, Sasha Levin , jack@suse.com, linux-ext4@vger.kernel.org Subject: [PATCH AUTOSEL 5.18 13/53] ext2: Add more validity checks for inode counts Date: Sun, 7 Aug 2022 21:33:08 -0400 Message-Id: <20220808013350.314757-13-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220808013350.314757-1-sashal@kernel.org> References: <20220808013350.314757-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Jan Kara [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems. Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index f6a19f6d9f6d..cdffa2a041af 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1059,9 +1059,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_frags_per_group); goto failed_mount; } - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, - "error: #inodes per group too big: %lu", + "error: invalid #inodes per group: %lu", sbi->s_inodes_per_group); goto failed_mount; } @@ -1071,6 +1072,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != + le32_to_cpu(es->s_inodes_count)) { + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", + le32_to_cpu(es->s_inodes_count), + (u64)sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / EXT2_DESC_PER_BLOCK(sb); sbi->s_group_desc = kmalloc_array(db_count, -- 2.35.1