From owner-svn-src-all@freebsd.org Sat Jul 27 19:29:29 2019 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id C3D73C08B3; Sat, 27 Jul 2019 19:29:29 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 9A5236B7A1; Sat, 27 Jul 2019 19:29:29 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 06F0542E0; Sat, 27 Jul 2019 19:29:29 +0000 (UTC) (envelope-from fsu@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x6RJTSBG049298; Sat, 27 Jul 2019 19:29:28 GMT (envelope-from fsu@FreeBSD.org) Received: (from fsu@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x6RJTSos049297; Sat, 27 Jul 2019 19:29:28 GMT (envelope-from fsu@FreeBSD.org) Message-Id: <201907271929.x6RJTSos049297@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: fsu set sender to fsu@FreeBSD.org using -f From: Fedor Uporov Date: Sat, 27 Jul 2019 19:29:28 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r350385 - stable/11/sys/fs/ext2fs X-SVN-Group: stable-11 X-SVN-Commit-Author: fsu X-SVN-Commit-Paths: stable/11/sys/fs/ext2fs X-SVN-Commit-Revision: 350385 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 9A5236B7A1 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.90 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.90)[-0.904,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 19:29:29 -0000 Author: fsu Date: Sat Jul 27 19:29:28 2019 New Revision: 350385 URL: https://svnweb.freebsd.org/changeset/base/350385 Log: MFC r349800,r349801,r349802: Fix misc fs fuzzing issues. Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE Reported as: FS-27-EXT2-12: Denial of Service in openat-0 (vm_fault_hold/ext2_clusteracct) FS-22-EXT2-9: Denial of service in ftruncate-0 (ext2_balloc) FS-11-EXT2-6: Denial Of Service in write-1 (ext2_balloc) Modified: stable/11/sys/fs/ext2fs/ext2_balloc.c stable/11/sys/fs/ext2fs/ext2_vfsops.c Modified: stable/11/sys/fs/ext2fs/ext2_balloc.c ============================================================================== --- stable/11/sys/fs/ext2fs/ext2_balloc.c Sat Jul 27 19:29:23 2019 (r350384) +++ stable/11/sys/fs/ext2fs/ext2_balloc.c Sat Jul 27 19:29:28 2019 (r350385) @@ -67,7 +67,7 @@ ext2_balloc(struct inode *ip, e2fs_lbn_t lbn, int size struct indir indirs[NIADDR + 2]; e4fs_daddr_t nb, newb; e2fs_daddr_t *bap, pref; - int osize, nsize, num, i, error; + int num, i, error; *bpp = NULL; if (lbn < 0) @@ -93,56 +93,25 @@ ext2_balloc(struct inode *ip, e2fs_lbn_t lbn, int size * no new block is to be allocated, and no need to expand * the file */ - if (nb != 0 && ip->i_size >= (lbn + 1) * fs->e2fs_bsize) { + if (nb != 0) { error = bread(vp, lbn, fs->e2fs_bsize, NOCRED, &bp); if (error) { brelse(bp); return (error); } bp->b_blkno = fsbtodb(fs, nb); - *bpp = bp; - return (0); - } - if (nb != 0) { - /* - * Consider need to reallocate a fragment. - */ - osize = fragroundup(fs, blkoff(fs, ip->i_size)); - nsize = fragroundup(fs, size); - if (nsize <= osize) { - error = bread(vp, lbn, osize, NOCRED, &bp); - if (error) { - brelse(bp); - return (error); - } - bp->b_blkno = fsbtodb(fs, nb); - } else { - /* - * Godmar thinks: this shouldn't happen w/o - * fragments - */ - printf("nsize %d(%d) > osize %d(%d) nb %d\n", - (int)nsize, (int)size, (int)osize, - (int)ip->i_size, (int)nb); - panic( - "ext2_balloc: Something is terribly wrong"); -/* - * please note there haven't been any changes from here on - - * FFS seems to work. - */ + if (ip->i_size >= (lbn + 1) * fs->e2fs_bsize) { + *bpp = bp; + return (0); } } else { - if (ip->i_size < (lbn + 1) * fs->e2fs_bsize) - nsize = fragroundup(fs, size); - else - nsize = fs->e2fs_bsize; EXT2_LOCK(ump); error = ext2_alloc(ip, lbn, ext2_blkpref(ip, lbn, (int)lbn, &ip->i_db[0], 0), - nsize, cred, &newb); + fs->e2fs_bsize, cred, &newb); if (error) return (error); - bp = getblk(vp, lbn, nsize, 0, 0, 0); + bp = getblk(vp, lbn, fs->e2fs_bsize, 0, 0, 0); bp->b_blkno = fsbtodb(fs, newb); if (flags & BA_CLRBUF) vfs_bio_clrbuf(bp); @@ -227,7 +196,6 @@ ext2_balloc(struct inode *ip, e2fs_lbn_t lbn, int size */ if ((error = bwrite(nbp)) != 0) { ext2_blkfree(ip, nb, fs->e2fs_bsize); - EXT2_UNLOCK(ump); brelse(bp); return (error); } Modified: stable/11/sys/fs/ext2fs/ext2_vfsops.c ============================================================================== --- stable/11/sys/fs/ext2fs/ext2_vfsops.c Sat Jul 27 19:29:23 2019 (r350384) +++ stable/11/sys/fs/ext2fs/ext2_vfsops.c Sat Jul 27 19:29:28 2019 (r350385) @@ -375,8 +375,11 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es return (EINVAL); } /* Check for group size */ - if (fs->e2fs_bpg == 0) { - printf("ext2fs: zero blocks per group\n"); + if (fs->e2fs_bpg == 0 || fs->e2fs_fpg == 0) { + printf("ext2fs: zero blocks/fragments per group"); + return (EINVAL); + } else if (fs->e2fs_bpg != fs->e2fs_fpg) { + printf("ext2fs: blocks per group not equal fragments per group"); return (EINVAL); } if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {