Commit fa78f336 authored by Jan Kara's avatar Jan Kara
Browse files

ext2: Add more validity checks for inode counts 



Add checks verifying number of inodes stored in the superblock matches
the number computed from number of inodes per group. Also verify we have
at least one block worth of inodes per group. This prevents crashes on
corrupted filesystems.

Reported-by: default avatar <syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent bd6e21a9

fs/ext2/super.c

+10 −2
Original line number Diff line number Diff line
@@ -1059,9 +1059,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
			sbi->s_frags_per_group);

		goto failed_mount;

	}

	if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {

	if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||

	    sbi->s_inodes_per_group > sb->s_blocksize * 8) {

		ext2_msg(sb, KERN_ERR,

			"error: #inodes per group too big: %lu",

			"error: invalid #inodes per group: %lu",

			sbi->s_inodes_per_group);

		goto failed_mount;

	}
@@ -1071,6 +1072,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
	sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -

				le32_to_cpu(es->s_first_data_block) - 1)

					/ EXT2_BLOCKS_PER_GROUP(sb)) + 1;

	if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=

	    le32_to_cpu(es->s_inodes_count)) {

		ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",

			 le32_to_cpu(es->s_inodes_count),

			 (u64)sbi->s_groups_count * sbi->s_inodes_per_group);

		goto failed_mount;

	}

	db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /

		   EXT2_DESC_PER_BLOCK(sb);

	sbi->s_group_desc = kmalloc_array(db_count,