Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 28 Jan 2019 02:12:48 +0000 (UTC)
From:      "Pedro F. Giffuni" <pfg@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r343517 - stable/11/sys/fs/ext2fs
Message-ID:  <201901280212.x0S2CmJ2016740@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: pfg
Date: Mon Jan 28 02:12:48 2019
New Revision: 343517
URL: https://svnweb.freebsd.org/changeset/base/343517

Log:
  MFC r343459: (parcial)
  ext2fs: Add some extra consistency checks for the superblock.
  
  Maliciously formed, or badly corrupted, filesystems can cause kernel
  panics.  In general, such acts of foot-shooting can only be accomplished
  by root, but in a world with VM images that is  moving towards automated
  mounts it is important to have some form of prevention.
  
  Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert
  of Fraunhofer FKIE.
  Incidentaly this should also fix a memory corruption issue reported by
  Dr Silvio Cesare of InfoSect.
  
  Huge thanks to all reseachers for making us aware of the issue.
  
  Note: for the MFC to stable/11 several changes had to made.
  
  admbug:		872, 891
  Reviewed by:	fsu
  Obtained from:	NetBSD (with changes)

Modified:
  stable/11/sys/fs/ext2fs/ext2_vfsops.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/fs/ext2fs/ext2_vfsops.c
==============================================================================
--- stable/11/sys/fs/ext2fs/ext2_vfsops.c	Mon Jan 28 02:00:39 2019	(r343516)
+++ stable/11/sys/fs/ext2fs/ext2_vfsops.c	Mon Jan 28 02:12:48 2019	(r343517)
@@ -369,8 +369,27 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es
 		    es->e3fs_desc_size);
 		return (EINVAL);
 	}
+	/* Check for block size = 1K|2K|4K */
+	if (es->e2fs_log_bsize > 2) {
+		printf("ext2fs: bad block size: %d\n", es->e2fs_log_bsize);
+		return (EINVAL);
+	}
+	/* Check for group size */
+	if (fs->e2fs_bpg == 0) {
+		printf("ext2fs: zero blocks per group\n");
+		return (EINVAL);
+	}
+	if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {
+		printf("ext2fs: non-standard group size unsupported %d\n",
+		    fs->e2fs_bpg);
+		return (EINVAL);
+	}
 
 	fs->e2fs_ipb = fs->e2fs_bsize / EXT2_INODE_SIZE(fs);
+	if (fs->e2fs_ipg == 0) {
+		printf("ext2fs: zero inodes per group\n");
+		return (EINVAL);
+	}
 	fs->e2fs_itpg = fs->e2fs_ipg / fs->e2fs_ipb;
 	/* s_resuid / s_resgid ? */
 	fs->e2fs_gcount = howmany(es->e2fs_bcount - es->e2fs_first_dblock,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901280212.x0S2CmJ2016740>