From owner-svn-src-all@freebsd.org Mon Mar 4 11:01:24 2019 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4AA79150C768; Mon, 4 Mar 2019 11:01:24 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id E15EF93BE2; Mon, 4 Mar 2019 11:01:23 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id BCEF23093; Mon, 4 Mar 2019 11:01:23 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x24B1NpM017902; Mon, 4 Mar 2019 11:01:23 GMT (envelope-from fsu@FreeBSD.org) Received: (from fsu@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x24B1NZk017901; Mon, 4 Mar 2019 11:01:23 GMT (envelope-from fsu@FreeBSD.org) Message-Id: <201903041101.x24B1NZk017901@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: fsu set sender to fsu@FreeBSD.org using -f From: Fedor Uporov Date: Mon, 4 Mar 2019 11:01:23 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r344753 - head/sys/fs/ext2fs X-SVN-Group: head X-SVN-Commit-Author: fsu X-SVN-Commit-Paths: head/sys/fs/ext2fs X-SVN-Commit-Revision: 344753 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: E15EF93BE2 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.98 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.98)[-0.981,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2019 11:01:24 -0000 Author: fsu Date: Mon Mar 4 11:01:23 2019 New Revision: 344753 URL: https://svnweb.freebsd.org/changeset/base/344753 Log: Validate block bitmaps. Reviewed by: pfg MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D19324 Modified: head/sys/fs/ext2fs/ext2_alloc.c Modified: head/sys/fs/ext2fs/ext2_alloc.c ============================================================================== --- head/sys/fs/ext2fs/ext2_alloc.c Mon Mar 4 10:55:01 2019 (r344752) +++ head/sys/fs/ext2fs/ext2_alloc.c Mon Mar 4 11:01:23 2019 (r344753) @@ -902,6 +902,52 @@ ext2_cg_block_bitmap_init(struct m_ext2fs *fs, int cg, return (0); } +static int +ext2_b_bitmap_validate(struct m_ext2fs *fs, struct buf *bp, int cg) +{ + struct ext2_gd *gd; + uint64_t group_first_block; + unsigned int offset, max_bit; + + if (EXT2_HAS_INCOMPAT_FEATURE(fs, EXT2F_INCOMPAT_FLEX_BG)) { + /* + * It is not possible to check block bitmap in case of this feature, + * because the inode and block bitmaps and inode table + * blocks may not be in the group at all. + * So, skip check in this case. + */ + return (0); + } + + gd = &fs->e2fs_gd[cg]; + max_bit = fs->e2fs_fpg; + group_first_block = ((uint64_t)cg) * fs->e2fs->e2fs_fpg + + fs->e2fs->e2fs_first_dblock; + + /* Check block bitmap block number */ + offset = e2fs_gd_get_b_bitmap(gd) - group_first_block; + if (offset >= max_bit || !isset(bp->b_data, offset)) { + printf("ext2fs: bad block bitmap, group %d\n", cg); + return (EINVAL); + } + + /* Check inode bitmap block number */ + offset = e2fs_gd_get_i_bitmap(gd) - group_first_block; + if (offset >= max_bit || !isset(bp->b_data, offset)) { + printf("ext2fs: bad inode bitmap, group %d\n", cg); + return (EINVAL); + } + + /* Check inode table */ + offset = e2fs_gd_get_i_tables(gd) - group_first_block; + if (offset >= max_bit || offset + fs->e2fs_itpg >= max_bit) { + printf("ext2fs: bad inode table, group %d\n", cg); + return (EINVAL); + } + + return (0); +} + /* * Determine whether a block can be allocated. * @@ -922,40 +968,37 @@ ext2_alloccg(struct inode *ip, int cg, daddr_t bpref, ump = ip->i_ump; if (e2fs_gd_get_nbfree(&fs->e2fs_gd[cg]) == 0) return (0); + EXT2_UNLOCK(ump); error = bread(ip->i_devvp, fsbtodb(fs, e2fs_gd_get_b_bitmap(&fs->e2fs_gd[cg])), (int)fs->e2fs_bsize, NOCRED, &bp); - if (error) { - brelse(bp); - EXT2_LOCK(ump); - return (0); - } + if (error) + goto fail; + if (EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_GDT_CSUM) || EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_METADATA_CKSUM)) { error = ext2_cg_block_bitmap_init(fs, cg, bp); - if (error) { - brelse(bp); - EXT2_LOCK(ump); - return (0); - } + if (error) + goto fail; + ext2_gd_b_bitmap_csum_set(fs, cg, bp); } error = ext2_gd_b_bitmap_csum_verify(fs, cg, bp); - if (error) { - brelse(bp); - EXT2_LOCK(ump); - return (0); - } - if (e2fs_gd_get_nbfree(&fs->e2fs_gd[cg]) == 0) { - /* - * Another thread allocated the last block in this - * group while we were waiting for the buffer. - */ - brelse(bp); - EXT2_LOCK(ump); - return (0); - } + if (error) + goto fail; + + error = ext2_b_bitmap_validate(fs,bp, cg); + if (error) + goto fail; + + /* + * Check, that another thread did not not allocate the last block in this + * group while we were waiting for the buffer. + */ + if (e2fs_gd_get_nbfree(&fs->e2fs_gd[cg]) == 0) + goto fail; + bbp = (char *)bp->b_data; if (dtog(fs, bpref) != cg) @@ -1028,11 +1071,9 @@ retry: goto retry; } bno = ext2_mapsearch(fs, bbp, bpref); - if (bno < 0) { - brelse(bp); - EXT2_LOCK(ump); - return (0); - } + if (bno < 0) + goto fail; + gotit: #ifdef INVARIANTS if (isset(bbp, bno)) { @@ -1052,6 +1093,11 @@ gotit: ext2_gd_b_bitmap_csum_set(fs, cg, bp); bdwrite(bp); return (((uint64_t)cg) * fs->e2fs->e2fs_fpg + fs->e2fs->e2fs_first_dblock + bno); + +fail: + brelse(bp); + EXT2_LOCK(ump); + return (0); } /*