From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:34444 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750928AbdADKG0 (ORCPT ); Wed, 4 Jan 2017 05:06:26 -0500 Subject: Patch "ext4: add sanity checking to count_overhead()" has been added to the 4.8-stable tree To: tytso@mit.edu, gregkh@linuxfoundation.org Cc: , From: Date: Wed, 04 Jan 2017 11:06:43 +0100 Message-ID: <148352440386136@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ext4: add sanity checking to count_overhead() to the 4.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ext4-add-sanity-checking-to-count_overhead.patch and it can be found in the queue-4.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From c48ae41bafe31e9a66d8be2ced4e42a6b57fa814 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o Date: Fri, 18 Nov 2016 13:37:47 -0500 Subject: ext4: add sanity checking to count_overhead() From: Theodore Ts'o commit c48ae41bafe31e9a66d8be2ced4e42a6b57fa814 upstream. The commit "ext4: sanity check the block and cluster size at mount time" should prevent any problems, but in case the superblock is modified while the file system is mounted, add an extra safety check to make sure we won't overrun the allocated buffer. Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/super.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -3161,10 +3161,15 @@ static int count_overhead(struct super_b ext4_set_bit(s++, buf); count++; } - for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { - ext4_set_bit(EXT4_B2C(sbi, s++), buf); - count++; + j = ext4_bg_num_gdb(sb, grp); + if (s + j > EXT4_BLOCKS_PER_GROUP(sb)) { + ext4_error(sb, "Invalid number of block group " + "descriptor blocks: %d", j); + j = EXT4_BLOCKS_PER_GROUP(sb) - s; } + count += j; + for (; j > 0; j--) + ext4_set_bit(EXT4_B2C(sbi, s++), buf); } if (!count) return 0; Patches currently in stable-queue which might be from tytso@mit.edu are queue-4.8/ext4-reject-inodes-with-negative-size.patch queue-4.8/ext4-fix-in-superblock-mount-options-processing.patch queue-4.8/ext4-fix-mballoc-breakage-with-64k-block-size.patch queue-4.8/ext4-do-not-perform-data-journaling-when-data-is-encrypted.patch queue-4.8/ext4-use-more-strict-checks-for-inodes_per_block-on-mount.patch queue-4.8/ext4-add-sanity-checking-to-count_overhead.patch queue-4.8/ext4-return-enomem-instead-of-success.patch queue-4.8/ext4-fix-stack-memory-corruption-with-64k-block-size.patch