diff options
| author | Jan Kara <jack@suse.cz> | 2023-03-01 11:59:39 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-30 12:42:08 +0100 |
| commit | 451b98155be5dfee05bc6e7c8b30c0be4add3f71 (patch) | |
| tree | c45e64c55ddd3f63c4c8081f39135bfbf53a7e02 /fs/ext2 | |
| parent | 2bc34facb90ceeff6f8c17d2006575a6d07c3825 (diff) | |
| download | linux-stable-451b98155be5dfee05bc6e7c8b30c0be4add3f71.tar.gz linux-stable-451b98155be5dfee05bc6e7c8b30c0be4add3f71.tar.bz2 linux-stable-451b98155be5dfee05bc6e7c8b30c0be4add3f71.zip | |
ext2: Check block size validity during mount
[ Upstream commit 62aeb94433fcec80241754b70d0d1836d5926b0a ]
Check that log of block size stored in the superblock has sensible
value. Otherwise the shift computing the block size can overflow leading
to undefined behavior.
Reported-by: syzbot+4fec412f59eba8c01b77@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/ext2')
| -rw-r--r-- | fs/ext2/ext2.h | 1 | ||||
| -rw-r--r-- | fs/ext2/super.c | 7 |
2 files changed, 8 insertions, 0 deletions
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h index 00e759f05161..a203a5723e2c 100644 --- a/fs/ext2/ext2.h +++ b/fs/ext2/ext2.h @@ -177,6 +177,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb) #define EXT2_MIN_BLOCK_SIZE 1024 #define EXT2_MAX_BLOCK_SIZE 4096 #define EXT2_MIN_BLOCK_LOG_SIZE 10 +#define EXT2_MAX_BLOCK_LOG_SIZE 16 #define EXT2_BLOCK_SIZE(s) ((s)->s_blocksize) #define EXT2_ADDR_PER_BLOCK(s) (EXT2_BLOCK_SIZE(s) / sizeof (__u32)) #define EXT2_BLOCK_SIZE_BITS(s) ((s)->s_blocksize_bits) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index 44a1f356aca2..3349ce85d27c 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -978,6 +978,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) goto failed_mount; } + if (le32_to_cpu(es->s_log_block_size) > + (EXT2_MAX_BLOCK_LOG_SIZE - BLOCK_SIZE_BITS)) { + ext2_msg(sb, KERN_ERR, + "Invalid log block size: %u", + le32_to_cpu(es->s_log_block_size)); + goto failed_mount; + } blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size); if (sbi->s_mount_opt & EXT2_MOUNT_DAX) { |