d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ext2fs: Add some extra consistency checks for the superblock.

Browse Source 
Maliciously formed, or badly corrupted, filesystems can cause kernel
panics.  In general, such acts of foot-shooting can only be accomplished
by root, but in a world with VM images that is  moving towards automated
mounts it is important to have some form of prevention.

Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert
of Fraunhofer FKIE.
Incidentaly this should also fix a memory corruption issue reported by
Dr Silvio Cesare of InfoSect.

Huge thanks to all reseachers for making us aware of the issue.

admbug:		872, 891
Reviewed by:	fsu
Obtained from:	NetBSD (with minor changes)
MFC after:	3 days
This commit is contained in:
Pedro F. Giffuni 2019-01-25 22:22:29 +00:00
parent f913a5749f
commit 771ec59bb7
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=343459
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
sys/fs/ext2fs/ext2_vfsops.c
View File

@ -416,7 +416,16 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es,
es->e3fs_desc_size);
return (EINVAL);
}
/* Check for block size = 1K|2K|4K */
if (es->e2fs_log_bsize > 2) {
printf("ext2fs: bad block size: %d\n", es->e2fs_log_bsize);
return (EINVAL);
}
/* Check for group size */
if (fs->e2fs_bpg == 0) {
printf("ext2fs: zero blocks per group\n");
return (EINVAL);
}
if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {
printf("ext2fs: non-standard group size unsupported %d\n",
fs->e2fs_bpg);
@ -424,7 +433,21 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es,
}
fs->e2fs_ipb = fs->e2fs_bsize / EXT2_INODE_SIZE(fs);
if (fs->e2fs_ipg == 0) {
printf("ext2fs: zero inodes per group\n");
return (EINVAL);
}
fs->e2fs_itpg = fs->e2fs_ipg / fs->e2fs_ipb;
/* Check for block consistency */
if (es->e2fs_first_dblock >= fs->e2fs_bcount) {
printf("ext2fs: invalid first data block\n");
return (EINVAL);
}
if (fs->e2fs_rbcount > fs->e2fs_bcount ||
fs->e2fs_fbcount > fs->e2fs_bcount) {
printf("ext2fs: invalid block count\n");
return (EINVAL);
}
/* s_resuid / s_resgid ? */
fs->e2fs_gcount = howmany(fs->e2fs_bcount - es->e2fs_first_dblock,
EXT2_BLOCKS_PER_GROUP(fs));