Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64133595 authored by Jin Qian's avatar Jin Qian Committed by Greg Kroah-Hartman
Browse files

f2fs: sanity check checkpoint segno and blkoff 



commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream.

Make sure segno and blkoff read from raw image are valid.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJin Qian <jinqian@google.com>
[Jaegeuk Kim: adjust minor coding style]
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
[AmitP: Found in Android Security bulletin for Aug'17, fixes CVE-2017-10663]
Signed-off-by: default avatarAmit Pundir <amit.pundir@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 65d8b1d1

fs/f2fs/super.c

+16 −0
Original line number Diff line number Diff line
@@ -932,6 +932,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
	unsigned int total, fsmeta;

	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);

	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);

	unsigned int main_segs, blocks_per_seg;

	int i;



	total = le32_to_cpu(raw_super->segment_count);

	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
@@ -943,6 +945,20 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
	if (unlikely(fsmeta >= total))

		return 1;



	main_segs = le32_to_cpu(raw_super->segment_count_main);

	blocks_per_seg = sbi->blocks_per_seg;



	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||

			le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)

			return 1;

	}

	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||

			le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)

			return 1;

	}



	if (unlikely(f2fs_cp_error(sbi))) {

		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");

		return 1;