validate-s_first_meta_bg-at-mount-time

   1 ext4: validate s_first_meta_bg at mount time
   2
   3 From: Eryu Guan <guaneryu@gmail.com>
   4
   5 Ralf Spenneberg reported that he hit a kernel crash when mounting a
   6 modified ext4 image. And it turns out that kernel crashed when
   7 calculating fs overhead (ext4_calculate_overhead()), this is because
   8 the image has very large s_first_meta_bg (debug code shows it's
   9 842150400), and ext4 overruns the memory in count_overhead() when
  10 setting bitmap buffer, which is PAGE_SIZE.
  11
  12 ext4_calculate_overhead():
  13   buf = get_zeroed_page(GFP_NOFS);  <=== PAGE_SIZE buffer
  14   blks = count_overhead(sb, i, buf);
  15
  16 count_overhead():
  17   for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
  18           ext4_set_bit(EXT4_B2C(sbi, s++), buf);   <=== buffer overrun
  19           count++;
  20   }
  21
  22 This can be reproduced easily for me by this script:
  23
  24   #!/bin/bash
  25   rm -f fs.img
  26   mkdir -p /mnt/ext4
  27   fallocate -l 16M fs.img
  28   mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img
  29   debugfs -w -R "ssv first_meta_bg 842150400" fs.img
  30   mount -o loop fs.img /mnt/ext4
  31
  32 Fix it by validating s_first_meta_bg first at mount time, and
  33 refusing to mount if its value exceeds the largest possible meta_bg
  34 number.
  35
  36 Reported-by: Ralf Spenneberg <ralf@os-t.de>
  37 Signed-off-by: Eryu Guan <guaneryu@gmail.com>
  38 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  39 Reviewed-by: Andreas Dilger <adilger@dilger.ca>
  40 ---
  41
  42 In e2fsprogs, we avoided a similar buffer overrun:
  43 f66e6ce libext2fs: avoid buffer overflow if s_first_meta_bg is too big
  44
  45 and e2fsck could detect & fix large s_first_meta_bg:
  46 7a4352d e2fsck: fix file systems with an overly large s_first_meta_bg
  47
  48 But I suspect that there's an off-by-one bug in e2fsck code, shouldn't the
  49 upper boundary of s_first_meta_bg be (fs->desc_blocks - 1)? Something like:
  50
  51  e2fsck/super.c:643
  52         if (ext2fs_has_feature_meta_bg(fs->super) &&
  53  -           (fs->super->s_first_meta_bg > fs->desc_blocks)) {
  54  -               pctx.group = fs->desc_blocks;
  55  +           (fs->super->s_first_meta_bg >= fs->desc_blocks)) {
  56  +               pctx.group = fs->desc_blocks - 1;
  57                 pctx.num = fs->super->s_first_meta_bg;
  58
  59  fs/ext4/super.c | 9 +++++++++
  60  1 file changed, 9 insertions(+)
  61
  62 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
  63 index 52b0530..8f46a07 100644
  64 --- a/fs/ext4/super.c
  65 +++ b/fs/ext4/super.c
  66 @@ -3814,6 +3814,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
  67                         (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
  68         db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
  69                    EXT4_DESC_PER_BLOCK(sb);
  70 +       if (ext4_has_feature_meta_bg(sb)) {
  71 +               if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
  72 +                       ext4_msg(sb, KERN_WARNING,
  73 +                                "first meta block group too large: %u "
  74 +                                "(group descriptor block count %u)",
  75 +                                le32_to_cpu(es->s_first_meta_bg), db_count);
  76 +                       goto failed_mount;
  77 +               }
  78 +       }
  79         sbi->s_group_desc = ext4_kvmalloc(db_count *
  80                                           sizeof(struct buffer_head *),
  81                                           GFP_KERNEL);
  82 --
  83 2.9.3
  84
  85