add-sanity-checking-in-count_overhead

   1 ext4: add sanity checking to count_overhead()
   2
   3 The commit "ext4: sanity check the block and cluster size at mount
   4 time" should prevent any problems, but in case the superblock is
   5 modified while the file system is mounted, add an extra safety check
   6 to make sure we won't overrun the allocated buffer.
   7
   8 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
   9 Cc: stable@vger.kernel.org
  10 ---
  11  fs/ext4/super.c | 11 ++++++++---
  12  1 file changed, 8 insertions(+), 3 deletions(-)
  13
  14 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
  15 index 689c02df1af4..2d8a49d74f56 100644
  16 --- a/fs/ext4/super.c
  17 +++ b/fs/ext4/super.c
  18 @@ -3195,10 +3195,15 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
  19                         ext4_set_bit(s++, buf);
  20                         count++;
  21                 }
  22 -               for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) {
  23 -                       ext4_set_bit(EXT4_B2C(sbi, s++), buf);
  24 -                       count++;
  25 +               j = ext4_bg_num_gdb(sb, grp);
  26 +               if (s + j > EXT4_BLOCKS_PER_GROUP(sb)) {
  27 +                       ext4_error(sb, "Invalid number of block group "
  28 +                                  "descriptor blocks: %d", j);
  29 +                       j = EXT4_BLOCKS_PER_GROUP(sb) - s;
  30                 }
  31 +               count += j;
  32 +               for (; j > 0; j--)
  33 +                       ext4_set_bit(EXT4_B2C(sbi, s++), buf);
  34         }
  35         if (!count)
  36                 return 0;