From nobody Fri Dec 19 16:01:33 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F333C433FE for ; Sat, 22 Oct 2022 07:50:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231668AbiJVHs7 (ORCPT ); Sat, 22 Oct 2022 03:48:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231362AbiJVHsN (ORCPT ); Sat, 22 Oct 2022 03:48:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 124E1D03A8; Sat, 22 Oct 2022 00:45:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D2C7B60B1A; Sat, 22 Oct 2022 07:39:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E841BC433D6; Sat, 22 Oct 2022 07:39:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666424375; bh=JTa2qbkLTgeScZF6zKMRi8KfrP9jYtmRVYT8mvc0nDY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wojyhm6zr82CzO9sBrvipgtEMiZTSw1rOVFhTC3dBAGYDUhYRZhf7MYqr+oZgXUJG hZWHih0ch3raVnRBPixTvGUznrTi4DUqGE3YdPGnOc+UNng/5QFJiFpHkNDW2MrJwY uQIwrorEkP90nHcXjTQYGbisCqNqU+BJS44K0HIg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+0f2f7e65a3007d39539f@syzkaller.appspotmail.com, Jan Kara , kernel test robot Subject: [PATCH 5.19 122/717] ext2: Add sanity checks for group and filesystem size Date: Sat, 22 Oct 2022 09:20:01 +0200 Message-Id: <20221022072437.081515062@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit d766f2d1e3e3bd44024a7f971ffcf8b8fbb7c5d2 upstream. Add sanity check that filesystem size does not exceed the underlying device size and that group size is big enough so that metadata can fit into it. This avoid trying to mount some crafted filesystems with extremely large group counts. Reported-by: syzbot+0f2f7e65a3007d39539f@syzkaller.appspotmail.com Reported-by: kernel test robot # Test fixup CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/ext2/super.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1053,6 +1053,13 @@ static int ext2_fill_super(struct super_ sbi->s_blocks_per_group); goto failed_mount; } + /* At least inode table, bitmaps, and sb have to fit in one group */ + if (sbi->s_blocks_per_group <=3D sbi->s_itb_per_group + 3) { + ext2_msg(sb, KERN_ERR, + "error: #blocks per group smaller than metadata size: %lu <=3D %lu", + sbi->s_blocks_per_group, sbi->s_inodes_per_group + 3); + goto failed_mount; + } if (sbi->s_frags_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, "error: #fragments per group too big: %lu", @@ -1066,9 +1073,14 @@ static int ext2_fill_super(struct super_ sbi->s_inodes_per_group); goto failed_mount; } + if (sb_bdev_nr_blocks(sb) < le32_to_cpu(es->s_blocks_count)) { + ext2_msg(sb, KERN_ERR, + "bad geometry: block count %u exceeds size of device (%u blocks)", + le32_to_cpu(es->s_blocks_count), + (unsigned)sb_bdev_nr_blocks(sb)); + goto failed_mount; + } =20 - if (EXT2_BLOCKS_PER_GROUP(sb) =3D=3D 0) - goto cantfind_ext2; sbi->s_groups_count =3D ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1;