Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4813f85 authored by Jan Kara's avatar Jan Kara Committed by Greg Kroah-Hartman
Browse files

ext2: Check block size validity during mount 



[ Upstream commit 62aeb94433fcec80241754b70d0d1836d5926b0a ]

Check that log of block size stored in the superblock has sensible
value. Otherwise the shift computing the block size can overflow leading
to undefined behavior.

Reported-by: default avatar <syzbot+4fec412f59eba8c01b77@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 56c7e9c3

fs/ext2/ext2.h

+1 −0
Original line number Diff line number Diff line
@@ -177,6 +177,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb) 
#define EXT2_MIN_BLOCK_SIZE		1024

#define	EXT2_MAX_BLOCK_SIZE		4096

#define EXT2_MIN_BLOCK_LOG_SIZE		  10

#define EXT2_MAX_BLOCK_LOG_SIZE		  16

#define EXT2_BLOCK_SIZE(s)		((s)->s_blocksize)

#define	EXT2_ADDR_PER_BLOCK(s)		(EXT2_BLOCK_SIZE(s) / sizeof (__u32))

#define EXT2_BLOCK_SIZE_BITS(s)		((s)->s_blocksize_bits)

fs/ext2/super.c

+7 −0
Original line number Diff line number Diff line
@@ -967,6 +967,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
		goto failed_mount;

	}



	if (le32_to_cpu(es->s_log_block_size) >

	    (EXT2_MAX_BLOCK_LOG_SIZE - BLOCK_SIZE_BITS)) {

		ext2_msg(sb, KERN_ERR,

			 "Invalid log block size: %u",

			 le32_to_cpu(es->s_log_block_size));

		goto failed_mount;

	}

	blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);



	if (test_opt(sb, DAX)) {