Page MenuHomeFreeBSD

ext2: Check for e2fs_first_dblock in ext2_compute_sb_data()
ClosedPublic

Authored by nc on Tue, Nov 16, 11:01 PM.

Details

Summary

This prevents a kernel panic on a damaged ext2 superblock.

PR: 259107
Reported by: Robert Morris <rtm@lcs.mit.edu>

Test Plan

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

nc requested review of this revision.Tue, Nov 16, 11:01 PM
nc edited the test plan for this revision. (Show Details)

Oops, forgot one thing.

I have some good news, this works!

With patch:

root@fatbox:~ # mount -t ext2fs /dev/md0 /mnt
mount: /dev/md0: Invalid argument
root@fatbox:~ #

The first data block value check should be more complex. See s_first_data_block superblock field here:
https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout

Thanks for the suggestions! I have (hopefully) incoroprated it in this patch.

This version of e2fs_first_dblock check will fail on 1k block size. The

fs->e2fs->e2fs_bcount >= 1024

is always true.

Ok, let's change e2fs_first_dblock check (ext2_vfsops.c, line 621) from:

	if (le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) {
		SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
		    "first data block out of range");
		return (EINVAL);
	}

to

if (le32toh(es->e2fs_first_dblock) != (fs->e2fs_bsize > 1024 ? 0 : 1) ||
    le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) {
         SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
            "first data block is invalid");
         return (EINVAL);
 }

Sorry for the delay. Thanks for the suggestion! Incorporated it!

This revision is now accepted and ready to land.Sun, Nov 28, 2:41 PM