diff options
| author | Jan Kara <[email protected]> | 2022-09-14 17:24:42 +0200 |
|---|---|---|
| committer | Jan Kara <[email protected]> | 2022-09-26 14:59:47 +0200 |
| commit | d766f2d1e3e3bd44024a7f971ffcf8b8fbb7c5d2 (patch) | |
| tree | d23753369dd040ebdab78145b532455e0f9997ea | |
| parent | 6c78973da0b11255d2668518ac1baba4c581811a (diff) | |
ext2: Add sanity checks for group and filesystem size
Add sanity check that filesystem size does not exceed the underlying
device size and that group size is big enough so that metadata can fit
into it. This avoid trying to mount some crafted filesystems with
extremely large group counts.
Reported-by: [email protected]
Reported-by: kernel test robot <[email protected]> # Test fixup
CC: [email protected]
Signed-off-by: Jan Kara <[email protected]>
| -rw-r--r-- | fs/ext2/super.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/fs/ext2/super.c b/fs/ext2/super.c index 252c742379cf..afb31af9302d 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1052,6 +1052,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_blocks_per_group); goto failed_mount; } + /* At least inode table, bitmaps, and sb have to fit in one group */ + if (sbi->s_blocks_per_group <= sbi->s_itb_per_group + 3) { + ext2_msg(sb, KERN_ERR, + "error: #blocks per group smaller than metadata size: %lu <= %lu", + sbi->s_blocks_per_group, sbi->s_inodes_per_group + 3); + goto failed_mount; + } if (sbi->s_frags_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, "error: #fragments per group too big: %lu", @@ -1065,9 +1072,14 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_inodes_per_group); goto failed_mount; } + if (sb_bdev_nr_blocks(sb) < le32_to_cpu(es->s_blocks_count)) { + ext2_msg(sb, KERN_ERR, + "bad geometry: block count %u exceeds size of device (%u blocks)", + le32_to_cpu(es->s_blocks_count), + (unsigned)sb_bdev_nr_blocks(sb)); + goto failed_mount; + } - if (EXT2_BLOCKS_PER_GROUP(sb) == 0) - goto cantfind_ext2; sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; |