Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e7c95593001cb96ef5dd121a4523286c574c7133
Commit:     e7c95593001cb96ef5dd121a4523286c574c7133
Parent:     07620f69eff6671fea6bd382c95709f757e33768
Author:     Eric Sandeen <[EMAIL PROTECTED]>
AuthorDate: Mon Jan 28 23:58:27 2008 -0500
Committer:  Theodore Ts'o <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 23:58:27 2008 -0500

    ext4: fix oops on corrupted ext4 mount
    
    When mounting an ext4 filesystem with corrupted s_first_data_block, things
    can go very wrong and oops.
    
    Because blocks_count in ext4_fill_super is a u64, and we must use do_div,
    the calculation of db_count is done differently than on ext4.  If
    first_data_block is corrupted such that it is larger than ext4_blocks_count,
    for example, then the intermediate blocks_count value may go negative,
    but sign-extend to a very large value:
    
            blocks_count = (ext4_blocks_count(es) -
                            le32_to_cpu(es->s_first_data_block) +
                            EXT4_BLOCKS_PER_GROUP(sb) - 1);
    
    This is then assigned to s_groups_count which is an unsigned long:
    
            sbi->s_groups_count = blocks_count;
    
    This may result in a value of 0xFFFFFFFF which is then used to compute
    db_count:
    
            db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
                       EXT4_DESC_PER_BLOCK(sb);
    
    and in this case db_count will wind up as 0 because the addition overflows
    32 bits.  This in turn causes the kmalloc for group_desc to be of 0 size:
    
            sbi->s_group_desc = kmalloc(db_count * sizeof (struct buffer_head 
*),
                                        GFP_KERNEL);
    
    and eventually in ext4_check_descriptors, dereferencing
    sbi->s_group_desc[desc_block] will result in a NULL pointer dereference.
    
    The simplest test seems to be to sanity check s_first_data_block,
    EXT4_BLOCKS_PER_GROUP, and ext4_blocks_count values to be sure
    their combination won't result in a bad intermediate value for
    blocks_count.  We could just check for db_count == 0, but
    catching it at the root cause seems like it provides more info.
    
    Signed-off-by: Eric Sandeen <[EMAIL PROTECTED]>
    Reviewed-by: Mingming Cao <[EMAIL PROTECTED]>
---
 fs/ext4/super.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1484a08..32e3ecb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1997,6 +1997,17 @@ static int ext4_fill_super (struct super_block *sb, void 
*data, int silent)
 
        if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
                goto cantfind_ext4;
+
+       /* ensure blocks_count calculation below doesn't sign-extend */
+       if (ext4_blocks_count(es) + EXT4_BLOCKS_PER_GROUP(sb) <
+           le32_to_cpu(es->s_first_data_block) + 1) {
+               printk(KERN_WARNING "EXT4-fs: bad geometry: block count %llu, "
+                      "first data block %u, blocks per group %lu\n",
+                       ext4_blocks_count(es),
+                       le32_to_cpu(es->s_first_data_block),
+                       EXT4_BLOCKS_PER_GROUP(sb));
+               goto failed_mount;
+       }
        blocks_count = (ext4_blocks_count(es) -
                        le32_to_cpu(es->s_first_data_block) +
                        EXT4_BLOCKS_PER_GROUP(sb) - 1);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to