This is a note to let you know that I've just added the patch titled
ext4: validate s_reserved_gdt_blocks on mount
to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ext4-validate-s_reserved_gdt_blocks-on-mount.patch
and it can be found in the queue-4.7 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5b9554dc5bf008ae7f68a52e3d7e76c0920938a2 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Tue, 5 Jul 2016 20:01:52 -0400
Subject: ext4: validate s_reserved_gdt_blocks on mount
From: Theodore Ts'o <tytso@xxxxxxx>
commit 5b9554dc5bf008ae7f68a52e3d7e76c0920938a2 upstream.
If s_reserved_gdt_blocks is extremely large, it's possible for
ext4_init_block_bitmap(), which is called when ext4 sets up an
uninitialized block bitmap, to corrupt random kernel memory. Add the
same checks which e2fsck has --- it must never be larger than
blocksize / sizeof(__u32) --- and then add a backup check in
ext4_init_block_bitmap() in case the superblock gets modified after
the file system is mounted.
Reported-by: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext4/balloc.c | 3 +++
fs/ext4/super.c | 7 +++++++
2 files changed, 10 insertions(+)
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -208,6 +208,9 @@ static int ext4_init_block_bitmap(struct
memset(bh->b_data, 0, sb->s_blocksize);
bit_max = ext4_num_base_meta_clusters(sb, block_group);
+ if ((bit_max >> 3) >= bh->b_size)
+ return -EFSCORRUPTED;
+
for (bit = 0; bit < bit_max; bit++)
ext4_set_bit(bit, bh->b_data);
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3416,6 +3416,13 @@ static int ext4_fill_super(struct super_
goto failed_mount;
}
+ if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
+ ext4_msg(sb, KERN_ERR,
+ "Number of reserved GDT blocks insanely large: %d",
+ le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks));
+ goto failed_mount;
+ }
+
if (sbi->s_mount_opt & EXT4_MOUNT_DAX) {
err = bdev_dax_supported(sb, blocksize);
if (err)
Patches currently in stable-queue which might be from tytso@xxxxxxx are
queue-4.7/ext4-fix-deadlock-during-page-writeback.patch
queue-4.7/ext4-verify-extent-header-depth.patch
queue-4.7/ext4-short-cut-orphan-cleanup-on-error.patch
queue-4.7/ext4-check-for-extents-that-wrap-around.patch
queue-4.7/ext4-validate-s_reserved_gdt_blocks-on-mount.patch
queue-4.7/ext4-don-t-call-ext4_should_journal_data-on-the-journal-inode.patch
queue-4.7/random-strengthen-input-validation-for-rndaddtoentcnt.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html