Re: f2fs: sanity check segment count

[Jaegeuk Kim <jaegeuk@kernel.org>]

On 05/09, Jaegeuk Kim wrote:
> Hi Jin,
> 
> I'm been preparing -stable branches with the latest patches.
> Now, I'm working on 4.4, and will do for other versions as well.

Sorry, please ignore this message. ;)
I confused.

Thanks,

> 
> Thanks,
> 
> 2017-05-09 12:19 GMT-07:00 Jin Qian <jinqian@google.com>:
> 
> > Hi -
> >
> > Could you apply this patch to stable tree? It added a sanity check to
> > prevent someone crafting an image with huge segment_count to cause buffer
> > overflow or oom when loading the image.
> >
> > Thanks,
> > jin
> >
> > commit b9dd46188edc2f0d1f37328637860bb65a771124
> > Author: Jin Qian <jinqian@google.com>
> > Date:   Tue Apr 25 16:28:48 2017 -0700
> >
> >     f2fs: sanity check segment count
> >
> >     F2FS uses 4 bytes to represent block address. As a result, supported
> >     size of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.
> >
> >     Signed-off-by: Jin Qian <jinqian@google.com>
> >     Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
> >
> > diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
> > index 97c07a5153e9..4cd3bee6775f 100644
> > --- a/fs/f2fs/super.c
> > +++ b/fs/f2fs/super.c
> > @@ -1494,6 +1494,13 @@ static int sanity_check_raw_super(struct
> > f2fs_sb_info *sbi,
> >                 return 1;
> >         }
> >
> > +       if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) {
> > +               f2fs_msg(sb, KERN_INFO,
> > +                       "Invalid segment count (%u)",
> > +                       le32_to_cpu(raw_super->segment_count));
> > +               return 1;
> > +       }
> > +
> >         /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
> >         if (sanity_check_area_boundary(sbi, bh))
> >                 return 1;
> > diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
> > index 639cbdf65e2b..093549e10ee2 100644
> > --- a/include/linux/f2fs_fs.h
> > +++ b/include/linux/f2fs_fs.h
> > @@ -301,6 +301,12 @@ struct f2fs_nat_block {
> >  #define SIT_VBLOCK_MAP_SIZE 64
> >  #define SIT_ENTRY_PER_BLOCK (PAGE_SIZE / sizeof(struct f2fs_sit_entry))
> >
> > +/*
> > + * F2FS uses 4 bytes to represent block address. As a result, supported
> > size of
> > + * disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.
> > + */
> > +#define F2FS_MAX_SEGMENT       ((16 * 1024 * 1024) / 2)
> > +
> >  /*
> >   * Note that f2fs_sit_entry->vblocks has the following bit-field
> > information.
> >   * [15:10] : allocation type such as CURSEG_XXXX_TYPE
> >
> >
> >