Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca1d19b6 authored by Jin Qian's avatar Jin Qian Committed by Todd Poynor
Browse files

FROMLIST: f2fs: sanity check checkpoint segno and blkoff 

Make sure segno and blkoff read from raw image are valid.

(url https://sourceforge.net/p/linux-f2fs/mailman/message/35835945

)

Signed-off-by: default avatarJin Qian <jinqian@google.com>
Bug: 36588520
Change-Id: Iba66ab97d3d0870ea48b5ef192d9075f225a934a
parent 8ac44739

fs/f2fs/super.c

+18 −0
Original line number Diff line number Diff line
@@ -932,6 +932,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
	unsigned int total, fsmeta;

	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);

	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);

	unsigned int main_segs, blocks_per_seg;

	int i;



	total = le32_to_cpu(raw_super->segment_count);

	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
@@ -943,6 +945,22 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
	if (unlikely(fsmeta >= total))

		return 1;



	main_segs = le32_to_cpu(sbi->raw_super->segment_count_main);

	blocks_per_seg = sbi->blocks_per_seg;



	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||

		    le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg) {

			return 1;

		}

	}

	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||

		    le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg) {

			return 1;

		}

	}



	if (unlikely(f2fs_cp_error(sbi))) {

		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");

		return 1;