releases/4.4.140/ext4-add-more-mount-time-checks-of-the-superblock.patch

   1 From bfe0a5f47ada40d7984de67e59a7d3390b9b9ecc Mon Sep 17 00:00:00 2001
   2 From: Theodore Ts'o <tytso@mit.edu>
   3 Date: Sun, 17 Jun 2018 18:11:20 -0400
   4 Subject: ext4: add more mount time checks of the superblock
   5
   6 From: Theodore Ts'o <tytso@mit.edu>
   7
   8 commit bfe0a5f47ada40d7984de67e59a7d3390b9b9ecc upstream.
   9
  10 The kernel's ext4 mount-time checks were more permissive than
  11 e2fsprogs's libext2fs checks when opening a file system.  The
  12 superblock is considered too insane for debugfs or e2fsck to operate
  13 on it, the kernel has no business trying to mount it.
  14
  15 This will make file system fuzzing tools work harder, but the failure
  16 cases that they find will be more useful and be easier to evaluate.
  17
  18 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  19 Cc: stable@kernel.org
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21
  22 ---
  23  fs/ext4/super.c |   37 ++++++++++++++++++++++++++-----------
  24  1 file changed, 26 insertions(+), 11 deletions(-)
  25
  26 --- a/fs/ext4/super.c
  27 +++ b/fs/ext4/super.c
  28 @@ -3485,6 +3485,13 @@ static int ext4_fill_super(struct super_
  29                          le32_to_cpu(es->s_log_block_size));
  30                 goto failed_mount;
  31         }
  32 +       if (le32_to_cpu(es->s_log_cluster_size) >
  33 +           (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
  34 +               ext4_msg(sb, KERN_ERR,
  35 +                        "Invalid log cluster size: %u",
  36 +                        le32_to_cpu(es->s_log_cluster_size));
  37 +               goto failed_mount;
  38 +       }
  39
  40         if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
  41                 ext4_msg(sb, KERN_ERR,
  42 @@ -3630,13 +3637,6 @@ static int ext4_fill_super(struct super_
  43                                  "block size (%d)", clustersize, blocksize);
  44                         goto failed_mount;
  45                 }
  46 -               if (le32_to_cpu(es->s_log_cluster_size) >
  47 -                   (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
  48 -                       ext4_msg(sb, KERN_ERR,
  49 -                                "Invalid log cluster size: %u",
  50 -                                le32_to_cpu(es->s_log_cluster_size));
  51 -                       goto failed_mount;
  52 -               }
  53                 sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) -
  54                         le32_to_cpu(es->s_log_block_size);
  55                 sbi->s_clusters_per_group =
  56 @@ -3657,10 +3657,10 @@ static int ext4_fill_super(struct super_
  57                 }
  58         } else {
  59                 if (clustersize != blocksize) {
  60 -                       ext4_warning(sb, "fragment/cluster size (%d) != "
  61 -                                    "block size (%d)", clustersize,
  62 -                                    blocksize);
  63 -                       clustersize = blocksize;
  64 +                       ext4_msg(sb, KERN_ERR,
  65 +                                "fragment/cluster size (%d) != "
  66 +                                "block size (%d)", clustersize, blocksize);
  67 +                       goto failed_mount;
  68                 }
  69                 if (sbi->s_blocks_per_group > blocksize * 8) {
  70                         ext4_msg(sb, KERN_ERR,
  71 @@ -3714,6 +3714,13 @@ static int ext4_fill_super(struct super_
  72                          ext4_blocks_count(es));
  73                 goto failed_mount;
  74         }
  75 +       if ((es->s_first_data_block == 0) && (es->s_log_block_size == 0) &&
  76 +           (sbi->s_cluster_ratio == 1)) {
  77 +               ext4_msg(sb, KERN_WARNING, "bad geometry: first data "
  78 +                        "block is 0 with a 1k block and cluster size");
  79 +               goto failed_mount;
  80 +       }
  81 +
  82         blocks_count = (ext4_blocks_count(es) -
  83                         le32_to_cpu(es->s_first_data_block) +
  84                         EXT4_BLOCKS_PER_GROUP(sb) - 1);
  85 @@ -3749,6 +3756,14 @@ static int ext4_fill_super(struct super_
  86                 ret = -ENOMEM;
  87                 goto failed_mount;
  88         }
  89 +       if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
  90 +           le32_to_cpu(es->s_inodes_count)) {
  91 +               ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
  92 +                        le32_to_cpu(es->s_inodes_count),
  93 +                        ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
  94 +               ret = -EINVAL;
  95 +               goto failed_mount;
  96 +       }
  97
  98         bgl_lock_init(sbi->s_blockgroup_lock);
  99