Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit deaeed5b authored by Jin Qian's avatar Jin Qian Committed by Jaegeuk Kim
Browse files

f2fs: sanity check checkpoint segno and blkoff 



Make sure segno and blkoff read from raw image are valid.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJin Qian <jinqian@google.com>
[Jaegeuk Kim: adjust minor coding style]
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent b879d0bc

fs/f2fs/super.c

+16 −0
Original line number Diff line number Diff line
@@ -1509,6 +1509,8 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);

	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);

	unsigned int ovp_segments, reserved_segments;

	unsigned int main_segs, blocks_per_seg;

	int i;



	total = le32_to_cpu(raw_super->segment_count);

	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
@@ -1530,6 +1532,20 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi) 
		return 1;

	}



	main_segs = le32_to_cpu(raw_super->segment_count_main);

	blocks_per_seg = sbi->blocks_per_seg;



	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||

			le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)

			return 1;

	}

	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {

		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||

			le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)

			return 1;

	}



	if (unlikely(f2fs_cp_error(sbi))) {

		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");

		return 1;