From nobody Fri Sep 5 20:16:44 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEBC0C32772 for ; Tue, 23 Aug 2022 11:15:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357328AbiHWLPJ (ORCPT ); Tue, 23 Aug 2022 07:15:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40816 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243911AbiHWLOd (ORCPT ); Tue, 23 Aug 2022 07:14:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDEAB6B15D; Tue, 23 Aug 2022 02:18:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A29CE60F54; Tue, 23 Aug 2022 09:17:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96515C433D6; Tue, 23 Aug 2022 09:17:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661246270; bh=4oKy8Yajs9DOcAGOEyap/imW96KE11w4nqzOJVQiI90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tvYieE5MZPjV0YTe/GhL11d5z+sRuCfciBMqk5p3XoG916bQaN1lp3pL/XvjN3BbJ Xn3Xi6jIpdlZYo2jnGgQD6sjHdEMWArTLlHaSe8EE7K1wD64WqJWl5+YEfKa/MmfMj y1BRQP37gJ3UuelY1kjWdV71WmQQEoCNxjixT4Vc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 5.4 055/389] ext2: Add more validity checks for inode counts Date: Tue, 23 Aug 2022 10:22:13 +0200 Message-Id: <20220823080117.899460667@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080115.331990024@linuxfoundation.org> References: <20220823080115.331990024@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems. Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index db403c01d4d5..644c83c115bc 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1077,9 +1077,10 @@ static int ext2_fill_super(struct super_block *sb, v= oid *data, int silent) sbi->s_frags_per_group); goto failed_mount; } - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, - "error: #inodes per group too big: %lu", + "error: invalid #inodes per group: %lu", sbi->s_inodes_per_group); goto failed_mount; } @@ -1089,6 +1090,13 @@ static int ext2_fill_super(struct super_block *sb, v= oid *data, int silent) sbi->s_groups_count =3D ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=3D + le32_to_cpu(es->s_inodes_count)) { + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", + le32_to_cpu(es->s_inodes_count), + (u64)sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count =3D (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / EXT2_DESC_PER_BLOCK(sb); sbi->s_group_desc =3D kmalloc_array (db_count, --=20 2.35.1