On Thu, Feb 16, 2017 at 11:32:11AM +0100, Jiri Slaby wrote: > From: Eryu Guan <guaneryu@xxxxxxxxx> > > This patch has been added to the 3.12 stable tree. If you have any > objections, please let us know. This patch needs a further fix, Ted has just sent a fix to ext4 list https://www.spinics.net/lists/stable/msg159312.html Maybe the two patches should be pulled in together when the new fix hit upstream. Thanks Ted for fixing it! (Sorry for introducing bugs..) Eryu > > =============== > > commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream. > > Ralf Spenneberg reported that he hit a kernel crash when mounting a > modified ext4 image. And it turns out that kernel crashed when > calculating fs overhead (ext4_calculate_overhead()), this is because > the image has very large s_first_meta_bg (debug code shows it's > 842150400), and ext4 overruns the memory in count_overhead() when > setting bitmap buffer, which is PAGE_SIZE. > > ext4_calculate_overhead(): > buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer > blks = count_overhead(sb, i, buf); > > count_overhead(): > for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400 > ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun > count++; > } > > This can be reproduced easily for me by this script: > > #!/bin/bash > rm -f fs.img > mkdir -p /mnt/ext4 > fallocate -l 16M fs.img > mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img > debugfs -w -R "ssv first_meta_bg 842150400" fs.img > mount -o loop fs.img /mnt/ext4 > > Fix it by validating s_first_meta_bg first at mount time, and > refusing to mount if its value exceeds the largest possible meta_bg > number. > > [js] use EXT4_HAS_INCOMPAT_FEATURE instead of new > ext4_has_feature_meta_bg > > Reported-by: Ralf Spenneberg <ralf@xxxxxxx> > Signed-off-by: Eryu Guan <guaneryu@xxxxxxxxx> > Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> > Reviewed-by: Andreas Dilger <adilger@xxxxxxxxx> > Signed-off-by: Jiri Slaby <jslaby@xxxxxxx> > --- > fs/ext4/super.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/fs/ext4/super.c b/fs/ext4/super.c > index 6362896f5875..a263fa90edfa 100644 > --- a/fs/ext4/super.c > +++ b/fs/ext4/super.c > @@ -3852,6 +3852,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) > (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); > db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / > EXT4_DESC_PER_BLOCK(sb); > + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG)) { > + if (le32_to_cpu(es->s_first_meta_bg) >= db_count) { > + ext4_msg(sb, KERN_WARNING, > + "first meta block group too large: %u " > + "(group descriptor block count %u)", > + le32_to_cpu(es->s_first_meta_bg), db_count); > + goto failed_mount; > + } > + } > sbi->s_group_desc = ext4_kvmalloc(db_count * > sizeof(struct buffer_head *), > GFP_KERNEL); > -- > 2.11.1 >