| From 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Mon Sep 17 00:00:00 2001 |
| From: Eryu Guan <guaneryu@gmail.com> |
| Date: Thu, 1 Dec 2016 15:08:37 -0500 |
| Subject: ext4: validate s_first_meta_bg at mount time |
| |
| From: Eryu Guan <guaneryu@gmail.com> |
| |
| commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream. |
| |
| Ralf Spenneberg reported that he hit a kernel crash when mounting a |
| modified ext4 image. And it turns out that kernel crashed when |
| calculating fs overhead (ext4_calculate_overhead()), this is because |
| the image has very large s_first_meta_bg (debug code shows it's |
| 842150400), and ext4 overruns the memory in count_overhead() when |
| setting bitmap buffer, which is PAGE_SIZE. |
| |
| ext4_calculate_overhead(): |
| buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer |
| blks = count_overhead(sb, i, buf); |
| |
| count_overhead(): |
| for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400 |
| ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun |
| count++; |
| } |
| |
| This can be reproduced easily for me by this script: |
| |
| #!/bin/bash |
| rm -f fs.img |
| mkdir -p /mnt/ext4 |
| fallocate -l 16M fs.img |
| mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img |
| debugfs -w -R "ssv first_meta_bg 842150400" fs.img |
| mount -o loop fs.img /mnt/ext4 |
| |
| Fix it by validating s_first_meta_bg first at mount time, and |
| refusing to mount if its value exceeds the largest possible meta_bg |
| number. |
| |
| Reported-by: Ralf Spenneberg <ralf@os-t.de> |
| Signed-off-by: Eryu Guan <guaneryu@gmail.com> |
| Signed-off-by: Theodore Ts'o <tytso@mit.edu> |
| Reviewed-by: Andreas Dilger <adilger@dilger.ca> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/ext4/super.c | 9 +++++++++ |
| 1 file changed, 9 insertions(+) |
| |
| --- a/fs/ext4/super.c |
| +++ b/fs/ext4/super.c |
| @@ -3827,6 +3827,15 @@ static int ext4_fill_super(struct super_ |
| (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); |
| db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / |
| EXT4_DESC_PER_BLOCK(sb); |
| + if (ext4_has_feature_meta_bg(sb)) { |
| + if (le32_to_cpu(es->s_first_meta_bg) >= db_count) { |
| + ext4_msg(sb, KERN_WARNING, |
| + "first meta block group too large: %u " |
| + "(group descriptor block count %u)", |
| + le32_to_cpu(es->s_first_meta_bg), db_count); |
| + goto failed_mount; |
| + } |
| + } |
| sbi->s_group_desc = ext4_kvmalloc(db_count * |
| sizeof(struct buffer_head *), |
| GFP_KERNEL); |