verify-group-number-first-in-add_group-ioctl

   1 ext4: verify group number in verify_group_input() before using it
   2
   3 Check the group number for sanity earilier, before calling routines
   4 such as ext4_bg_has_super() or ext4_group_overhead_blocks().
   5
   6 Reported-by: Jonathan Salwan <jonathan.salwan@gmail.com>
   7 Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
   8 ---
   9  fs/ext4/resize.c | 17 +++++++++++------
  10  1 file changed, 11 insertions(+), 6 deletions(-)
  11
  12 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
  13 index b27c96d..6ed4df2 100644
  14 --- a/fs/ext4/resize.c
  15 +++ b/fs/ext4/resize.c
  16 @@ -79,12 +79,20 @@ static int verify_group_input(struct super_block *sb,
  17         ext4_fsblk_t end = start + input->blocks_count;
  18         ext4_group_t group = input->group;
  19         ext4_fsblk_t itend = input->inode_table + sbi->s_itb_per_group;
  20 -       unsigned overhead = ext4_group_overhead_blocks(sb, group);
  21 -       ext4_fsblk_t metaend = start + overhead;
  22 +       unsigned overhead;
  23 +       ext4_fsblk_t metaend;
  24         struct buffer_head *bh = NULL;
  25         ext4_grpblk_t free_blocks_count, offset;
  26         int err = -EINVAL;
  27
  28 +       if (group != sbi->s_groups_count) {
  29 +               ext4_warning(sb, "Cannot add at group %u (only %u groups)",
  30 +                            input->group, sbi->s_groups_count);
  31 +               return -EINVAL;
  32 +       }
  33 +
  34 +       overhead = ext4_group_overhead_blocks(sb, group);
  35 +       metaend = start + overhead;
  36         input->free_blocks_count = free_blocks_count =
  37                 input->blocks_count - 2 - overhead - sbi->s_itb_per_group;
  38
  39 @@ -96,10 +104,7 @@ static int verify_group_input(struct super_block *sb,
  40                        free_blocks_count, input->reserved_blocks);
  41
  42         ext4_get_group_no_and_offset(sb, start, NULL, &offset);
  43 -       if (group != sbi->s_groups_count)
  44 -               ext4_warning(sb, "Cannot add at group %u (only %u groups)",
  45 -                            input->group, sbi->s_groups_count);
  46 -       else if (offset != 0)
  47 +       if (offset != 0)
  48                         ext4_warning(sb, "Last group not full");
  49         else if (input->reserved_blocks > input->blocks_count / 5)
  50                 ext4_warning(sb, "Reserved blocks too high (%u)",