Date: Mon, 29 Nov 2021 17:54:08 GMT From: Neel Chauhan <nc@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 3dd3a395ba97 - main - ext2: Check for e2fs_first_dblock in ext2_compute_sb_data() Message-ID: <202111291754.1ATHs804040510@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by nc (ports committer): URL: https://cgit.FreeBSD.org/src/commit/?id=3dd3a395ba975d0fbe13320e6e69fb85b037da5e commit 3dd3a395ba975d0fbe13320e6e69fb85b037da5e Author: Neel Chauhan <nc@FreeBSD.org> AuthorDate: 2021-11-16 22:59:26 +0000 Commit: Neel Chauhan <nc@FreeBSD.org> CommitDate: 2021-11-29 17:53:45 +0000 ext2: Check for e2fs_first_dblock in ext2_compute_sb_data() This prevents a kernel panic on a damaged ext2 superblock. PR: 259107 Reported by: Robert Morris <rtm@lcs.mit.edu> Differential Revision: https://reviews.freebsd.org/D33029 --- sys/fs/ext2fs/ext2_vfsops.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sys/fs/ext2fs/ext2_vfsops.c b/sys/fs/ext2fs/ext2_vfsops.c index 65f429949f55..0ab0327ae074 100644 --- a/sys/fs/ext2fs/ext2_vfsops.c +++ b/sys/fs/ext2fs/ext2_vfsops.c @@ -465,6 +465,13 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es, int g_count = 0; int error; + /* Check if first dblock is valid */ + if (fs->e2fs->e2fs_bcount >= 1024 && fs->e2fs->e2fs_first_dblock) { + SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, + "first dblock is invalid"); + return (EINVAL); + } + /* Check checksum features */ if (EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_GDT_CSUM) && EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_METADATA_CKSUM)) { @@ -611,7 +618,8 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es, return (EINVAL); } - if (le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) { + if (le32toh(es->e2fs_first_dblock) != (fs->e2fs_bsize > 1024 ? 0 : 1) || + le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) { SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "first data block out of range"); return (EINVAL);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202111291754.1ATHs804040510>