d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ext2: Check for e2fs_first_dblock in ext2_compute_sb_data()

Browse Source 
This prevents a kernel panic on a damaged ext2 superblock.

PR:			259107
Reported by:		Robert Morris <rtm@lcs.mit.edu>
Differential Revision:	https://reviews.freebsd.org/D33029
This commit is contained in:
Neel Chauhan 2021-11-16 14:59:26 -08:00
parent 1910048eb9
commit 3dd3a395ba
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/fs/ext2fs/ext2_vfsops.c
View File

@ -465,6 +465,13 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es,
int g_count = 0;
int error;
/* Check if first dblock is valid */
if (fs->e2fs->e2fs_bcount >= 1024 && fs->e2fs->e2fs_first_dblock) {
SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
"first dblock is invalid");
return (EINVAL);
}
/* Check checksum features */
if (EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_GDT_CSUM) &&
EXT2_HAS_RO_COMPAT_FEATURE(fs, EXT2F_ROCOMPAT_METADATA_CKSUM)) {
@ -611,7 +618,8 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es,
return (EINVAL);
}
if (le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) {
if (le32toh(es->e2fs_first_dblock) != (fs->e2fs_bsize > 1024 ? 0 : 1) ||
le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) {
SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
"first data block out of range");
return (EINVAL);