e2fsck: never free critical metadata blocks in the block found map

Don't allow critical metadata blocks to be marked free in the block
found map.  This can theoretically happen on an FS where a first
inode's ETB/indirect map block is in the inode table, the first inode
is itself unclonable (and thus gets deleted) and there are enough
crosslinked files before and after the first inode to use up all the
free blocks during pass 1b.

(I do actually have a test FS image but it's 256M and it proved very
difficult to craft a bite-sized test case that actually hit this bug.)

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
index 26fe60cb87bd4b12b0a28fa974d557180bac1549..e7a6acd26fc383645d9a4935b5de026915eaddee 100644 (file)
--- a/e2fsck/pass1.c
+++ b/e2fsck/pass1.c
@@ -3356,6 +3356,13 @@ static void e2fsck_block_alloc_stats(ext2_filsys fs, blk64_t blk, int inuse)
 {
        e2fsck_t ctx = (e2fsck_t) fs->priv_data;
 
+       /* Never free a critical metadata block */
+       if (ctx->block_found_map &&
+           ctx->block_metadata_map &&
+           inuse < 0 &&
+           ext2fs_test_block_bitmap2(ctx->block_metadata_map, blk))
+               return;
+
        if (ctx->block_found_map) {
                if (inuse > 0)
                        ext2fs_mark_block_bitmap2(ctx->block_found_map, blk);