From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F102C19F2A for ; Mon, 8 Aug 2022 01:52:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243380AbiHHBws (ORCPT ); Sun, 7 Aug 2022 21:52:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38516 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243835AbiHHBv7 (ORCPT ); Sun, 7 Aug 2022 21:51:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E6478E086; Sun, 7 Aug 2022 18:38:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 29D63B80E10; Mon, 8 Aug 2022 01:38:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 007BFC433D6; Mon, 8 Aug 2022 01:38:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1659922723; bh=4oKy8Yajs9DOcAGOEyap/imW96KE11w4nqzOJVQiI90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BVpcnKtCHIIgJWMorbX1ZMoXu8+IOtKZ4BHoLjFJLStA1JwGfP5aDUVXKTPzcoJsz 8wVHrhKc2lQpQ/ek8oNHMpxJg7FxOjeNqD1xrKtUMDbByEBsnN9fMn5a0IyoTVALde chqSE8+8sZvQKE8Xbd0zdjMdoBuouH633N5/eAVTtsRYSzDL83cmUv7vJKPsV08fa6 GPqIcO9aIxNntN/0tWc2OdDnq8uYcWsOOy+eJ425iYkBpqOGes8wrqT2pH2HppaLxq 6YVlBb2Zcuz6vc0c4hXfk3ureqnJgDaonqg2meS9IWf/JXRKi+iqdZzio8oA9QA0jN Yr+xUvcIHj+zA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jan Kara , syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com, Sasha Levin , jack@suse.com, linux-ext4@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 04/23] ext2: Add more validity checks for inode counts Date: Sun, 7 Aug 2022 21:38:11 -0400 Message-Id: <20220808013832.316381-4-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220808013832.316381-1-sashal@kernel.org> References: <20220808013832.316381-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Jan Kara [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems. Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index db403c01d4d5..644c83c115bc 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1077,9 +1077,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_frags_per_group); goto failed_mount; } - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, - "error: #inodes per group too big: %lu", + "error: invalid #inodes per group: %lu", sbi->s_inodes_per_group); goto failed_mount; } @@ -1089,6 +1090,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != + le32_to_cpu(es->s_inodes_count)) { + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", + le32_to_cpu(es->s_inodes_count), + (u64)sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / EXT2_DESC_PER_BLOCK(sb); sbi->s_group_desc = kmalloc_array (db_count, -- 2.35.1