ext4: validate s_reserved_gdt_blocks on mount

Browse source

[ Upstream commit e1d8c1feecf672379c50ab045fd94548468bc987 ]

[ Upstream commit 5b9554dc5b ]

If s_reserved_gdt_blocks is extremely large, it's possible for
ext4_init_block_bitmap(), which is called when ext4 sets up an
uninitialized block bitmap, to corrupt random kernel memory.  Add the
same checks which e2fsck has --- it must never be larger than
blocksize / sizeof(__u32) --- and then add a backup check in
ext4_init_block_bitmap() in case the superblock gets modified after
the file system is mounted.

Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>

...

This commit is contained in:

Theodore Ts'o 2016-07-05 20:01:52 -04:00 • committed by Sasha Levin

parent 926d244dfa

commit 5467159ce7

2 changed files with 10 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

fs/ext4/balloc.c

View file

7

fs/ext4/super.c

View file