Patch "ext4: validate s_first_meta_bg at mount time" has been added to the 3.18-stable tree

Patch "ext4: validate s_first_meta_bg at mount time" has been added to the 3.18-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ext4: validate s_first_meta_bg at mount time

to the 3.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ext4-validate-s_first_meta_bg-at-mount-time.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Mon Sep 17 00:00:00 2001
From: Eryu Guan <guaneryu@gmail.com>
Date: Thu, 1 Dec 2016 15:08:37 -0500
Subject: ext4: validate s_first_meta_bg at mount time

From: Eryu Guan <guaneryu@gmail.com>

commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.

Ralf Spenneberg reported that he hit a kernel crash when mounting a
modified ext4 image. And it turns out that kernel crashed when
calculating fs overhead (ext4_calculate_overhead()), this is because
the image has very large s_first_meta_bg (debug code shows it's
842150400), and ext4 overruns the memory in count_overhead() when
setting bitmap buffer, which is PAGE_SIZE.

ext4_calculate_overhead():
  buf = get_zeroed_page(GFP_NOFS);  <=== PAGE_SIZE buffer
  blks = count_overhead(sb, i, buf);

count_overhead():
  for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
          ext4_set_bit(EXT4_B2C(sbi, s++), buf);   <=== buffer overrun
          count++;
  }

This can be reproduced easily for me by this script:

  #!/bin/bash
  rm -f fs.img
  mkdir -p /mnt/ext4
  fallocate -l 16M fs.img
  mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
  debugfs -w -R "ssv first_meta_bg 842150400" fs.img
  mount -o loop fs.img /mnt/ext4

Fix it by validating s_first_meta_bg first at mount time, and
refusing to mount if its value exceeds the largest possible meta_bg
number.

Reported-by: Ralf Spenneberg <ralf@os-t.de>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 fs/ext4/super.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3931,6 +3931,15 @@ static int ext4_fill_super(struct super_
 			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
 		   EXT4_DESC_PER_BLOCK(sb);
+	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG)) {
+		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
+			ext4_msg(sb, KERN_WARNING,
+				 "first meta block group too large: %u "
+				 "(group descriptor block count %u)",
+				 le32_to_cpu(es->s_first_meta_bg), db_count);
+			goto failed_mount;
+		}
+	}
 	sbi->s_group_desc = ext4_kvmalloc(db_count *
 					  sizeof(struct buffer_head *),
 					  GFP_KERNEL);


Patches currently in stable-queue which might be from guaneryu@gmail.com are

queue-3.18/ext4-validate-s_first_meta_bg-at-mount-time.patch

Re: Patch "ext4: validate s_first_meta_bg at mount time" has been added to the 3.18-stable tree

[Eryu Guan]

On Tue, Oct 10, 2017 at 08:15:37PM +0200, gregkh@linuxfoundation.org wrote:
> 
> This is a note to let you know that I've just added the patch titled
> 
>     ext4: validate s_first_meta_bg at mount time
> 
> to the 3.18-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> The filename of the patch is:
>      ext4-validate-s_first_meta_bg-at-mount-time.patch
> and it can be found in the queue-3.18 subdirectory.
> 
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
> 
> 
> From 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Mon Sep 17 00:00:00 2001
> From: Eryu Guan <guaneryu@gmail.com>
> Date: Thu, 1 Dec 2016 15:08:37 -0500
> Subject: ext4: validate s_first_meta_bg at mount time

This patch needs an additional fix, commit 2ba3e6e8afc9 ("ext4: fix
fencepost in s_first_meta_bg validation"), please make sure it's
included in the same stable update too.

Thanks,
Eryu

Re: Patch "ext4: validate s_first_meta_bg at mount time" has been added to the 3.18-stable tree

[Greg KH]

On Wed, Oct 11, 2017 at 12:01:43PM +0800, Eryu Guan wrote:
> On Tue, Oct 10, 2017 at 08:15:37PM +0200, gregkh@linuxfoundation.org wrote:
> > 
> > This is a note to let you know that I've just added the patch titled
> > 
> >     ext4: validate s_first_meta_bg at mount time
> > 
> > to the 3.18-stable tree which can be found at:
> >     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> > 
> > The filename of the patch is:
> >      ext4-validate-s_first_meta_bg-at-mount-time.patch
> > and it can be found in the queue-3.18 subdirectory.
> > 
> > If you, or anyone else, feels it should not be added to the stable tree,
> > please let <stable@vger.kernel.org> know about it.
> > 
> > 
> > From 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Mon Sep 17 00:00:00 2001
> > From: Eryu Guan <guaneryu@gmail.com>
> > Date: Thu, 1 Dec 2016 15:08:37 -0500
> > Subject: ext4: validate s_first_meta_bg at mount time
> 
> This patch needs an additional fix, commit 2ba3e6e8afc9 ("ext4: fix
> fencepost in s_first_meta_bg validation"), please make sure it's
> included in the same stable update too.

Ah, good catch, thanks for this, now queued up.

greg k-h