From owner-svn-src-stable-12@freebsd.org Fri Jul 26 21:08:02 2019 Return-Path: Delivered-To: svn-src-stable-12@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 6E065A9670; Fri, 26 Jul 2019 21:08:02 +0000 (UTC) (envelope-from pfg@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4EB0C82FEC; Fri, 26 Jul 2019 21:08:02 +0000 (UTC) (envelope-from pfg@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 19CC11CEB6; Fri, 26 Jul 2019 21:08:02 +0000 (UTC) (envelope-from pfg@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x6QL81p3048848; Fri, 26 Jul 2019 21:08:01 GMT (envelope-from pfg@FreeBSD.org) Received: (from pfg@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x6QL815X048847; Fri, 26 Jul 2019 21:08:01 GMT (envelope-from pfg@FreeBSD.org) Message-Id: <201907262108.x6QL815X048847@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: pfg set sender to pfg@FreeBSD.org using -f From: "Pedro F. Giffuni" Date: Fri, 26 Jul 2019 21:08:01 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r350366 - stable/12/sys/fs/ext2fs X-SVN-Group: stable-12 X-SVN-Commit-Author: pfg X-SVN-Commit-Paths: stable/12/sys/fs/ext2fs X-SVN-Commit-Revision: 350366 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 4EB0C82FEC X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.96)[-0.962,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: svn-src-stable-12@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for only the 12-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 21:08:02 -0000 Author: pfg Date: Fri Jul 26 21:08:01 2019 New Revision: 350366 URL: https://svnweb.freebsd.org/changeset/base/350366 Log: MFC r349802 (from fsu@): Add additional check for 'blocks per group' and 'fragments per group' superblock fields. These fields will not be equal only in case if bigalloc filesystem feature is turned on. This feature is not supported for now. Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE Reported as: FS-27-EXT2-12: Denial of Service in openat-0 (vm_fault_hold/ext2_clusteracct) Modified: stable/12/sys/fs/ext2fs/ext2_vfsops.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/fs/ext2fs/ext2_vfsops.c ============================================================================== --- stable/12/sys/fs/ext2fs/ext2_vfsops.c Fri Jul 26 19:35:33 2019 (r350365) +++ stable/12/sys/fs/ext2fs/ext2_vfsops.c Fri Jul 26 21:08:01 2019 (r350366) @@ -559,7 +559,12 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2f SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "zero blocks/fragments per group"); return (EINVAL); + } else if (fs->e2fs_bpg != fs->e2fs_fpg) { + SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, + "blocks per group not equal fragments per group"); + return (EINVAL); } + if (fs->e2fs_bpg != fs->e2fs_bsize * 8) { SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "non-standard group size unsupported");