From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B10C6C3F6B0 for ; Mon, 8 Aug 2022 01:52:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241912AbiHHBwU (ORCPT ); Sun, 7 Aug 2022 21:52:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243422AbiHHBu4 (ORCPT ); Sun, 7 Aug 2022 21:50:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9CE4218E3F; Sun, 7 Aug 2022 18:37:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 62562B80E0F; Mon, 8 Aug 2022 01:37:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B7B6C43470; Mon, 8 Aug 2022 01:37:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1659922672; bh=Hyuywz+z7CWKpmEKM5kFQPCFcyHEzObPK3WHe3L0lew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HpQmOu89Gj+ByApr6Vj91vO9ZM/gduta4w9jALl3Qg7eteYLI2Y3F9PfUeVODjXXl 86znIumB0pAXXgM3iN1E+4JZynpUikMKmRaTNj8LZMf9JlsB2TNB7PohetJ/l1mrxl KZjsfVgA8jelNhM8QG07k5lRNoIKRyWPsQvNRU+63iQN9MeSbXxdZ0qbD4ZZvbZHMr E4BrkxBPZYnYW2iUNHO+8UhWjjDTC6FIeVg9cqSOrd3Y3IIkpUeko3PdP9vmFw806l bGVjFXgtbSz1Gs0Uv9bHDuRm/2QJRkvCvtktsIWaCZhOvtINskp2Rxf1nfDv6MYQ8h e26yRqWGQg/2Q== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jan Kara , syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com, Sasha Levin , jack@suse.com, linux-ext4@vger.kernel.org Subject: [PATCH AUTOSEL 5.10 04/29] ext2: Add more validity checks for inode counts Date: Sun, 7 Aug 2022 21:37:14 -0400 Message-Id: <20220808013741.316026-4-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220808013741.316026-1-sashal@kernel.org> References: <20220808013741.316026-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Jan Kara [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems. Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index b6314d3c6a87..9a6475b2ab28 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1060,9 +1060,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_frags_per_group); goto failed_mount; } - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, - "error: #inodes per group too big: %lu", + "error: invalid #inodes per group: %lu", sbi->s_inodes_per_group); goto failed_mount; } @@ -1072,6 +1073,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != + le32_to_cpu(es->s_inodes_count)) { + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", + le32_to_cpu(es->s_inodes_count), + (u64)sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / EXT2_DESC_PER_BLOCK(sb); sbi->s_group_desc = kmalloc_array (db_count, -- 2.35.1