linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Theodore Tso <tytso@mit.edu>,
	stable@kernel.org
Subject: [PATCH 4.9 27/52] ext4: make sure bitmaps and the inode table dont overlap with bg descriptors
Date: Tue, 10 Jul 2018 20:24:55 +0200	[thread overview]
Message-ID: <20180710182451.996275202@linuxfoundation.org> (raw)
In-Reply-To: <20180710182449.285532226@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 77260807d1170a8cf35dbb06e07461a655f67eee upstream.

It's really bad when the allocation bitmaps and the inode table
overlap with the block group descriptors, since it causes random
corruption of the bg descriptors.  So we really want to head those off
at the pass.

https://bugzilla.kernel.org/show_bug.cgi?id=199865

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |   25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2231,6 +2231,7 @@ static int ext4_check_descriptors(struct
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
 	ext4_fsblk_t last_block;
+	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
 	ext4_fsblk_t block_bitmap;
 	ext4_fsblk_t inode_bitmap;
 	ext4_fsblk_t inode_table;
@@ -2263,6 +2264,14 @@ static int ext4_check_descriptors(struct
 			if (!(sb->s_flags & MS_RDONLY))
 				return 0;
 		}
+		if (block_bitmap >= sb_block + 1 &&
+		    block_bitmap <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Block bitmap for group %u overlaps "
+				 "block group descriptors", i);
+			if (!(sb->s_flags & MS_RDONLY))
+				return 0;
+		}
 		if (block_bitmap < first_block || block_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Block bitmap for group %u not in group "
@@ -2277,6 +2286,14 @@ static int ext4_check_descriptors(struct
 			if (!(sb->s_flags & MS_RDONLY))
 				return 0;
 		}
+		if (inode_bitmap >= sb_block + 1 &&
+		    inode_bitmap <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode bitmap for group %u overlaps "
+				 "block group descriptors", i);
+			if (!(sb->s_flags & MS_RDONLY))
+				return 0;
+		}
 		if (inode_bitmap < first_block || inode_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Inode bitmap for group %u not in group "
@@ -2291,6 +2308,14 @@ static int ext4_check_descriptors(struct
 			if (!(sb->s_flags & MS_RDONLY))
 				return 0;
 		}
+		if (inode_table >= sb_block + 1 &&
+		    inode_table <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode table for group %u overlaps "
+				 "block group descriptors", i);
+			if (!(sb->s_flags & MS_RDONLY))
+				return 0;
+		}
 		if (inode_table < first_block ||
 		    inode_table + sbi->s_itb_per_group - 1 > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "



  parent reply	other threads:[~2018-07-10 18:30 UTC|newest]

Thread overview: 60+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-10 18:24 [PATCH 4.9 00/52] 4.9.112-stable review Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 01/52] usb: cdc_acm: Add quirk for Uniden UBC125 scanner Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 02/52] USB: serial: cp210x: add CESINEL device ids Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 03/52] USB: serial: cp210x: add Silicon Labs IDs for Windows Update Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 04/52] usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 05/52] n_tty: Fix stall at n_tty_receive_char_special() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 06/52] n_tty: Access echo_* variables carefully Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 07/52] staging: android: ion: Return an ERR_PTR in ion_map_kernel Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 08/52] vt: prevent leaking uninitialized data to userspace via /dev/vcs* Greg Kroah-Hartman
2018-07-10 18:30   ` syzbot
2018-07-10 18:24 ` [PATCH 4.9 09/52] i2c: rcar: fix resume by always initializing registers before transfer Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 10/52] ipv4: Fix error return value in fib_convert_metrics() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 11/52] kprobes/x86: Do not modify singlestep buffer while resuming Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 12/52] netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 13/52] Revert "sit: reload iphdr in ipip6_rcv" Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 14/52] net: phy: micrel: fix crash when statistic requested for KSZ9031 phy Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 15/52] ARM: dts: imx6q: Use correct SDMA script for SPI5 core Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 16/52] IB/hfi1: Fix user context tail allocation for DMA_RTAIL Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 17/52] x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 18/52] x86/cpu: Re-apply forced caps every time CPU caps are re-read Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 19/52] mm: hugetlb: yield when prepping struct pages Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 20/52] tracing: Fix missing return symbol in function_graph output Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 21/52] scsi: sg: mitigate read/write abuse Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 22/52] s390: Correct register corruption in critical section cleanup Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 23/52] drbd: fix access after free Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 24/52] cifs: Fix infinite loop when using hard mount option Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 25/52] drm/udl: fix display corruption of the last line Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 26/52] jbd2: dont mark block as modified if the handle is out of credits Greg Kroah-Hartman
2018-07-10 18:24 ` Greg Kroah-Hartman [this message]
2018-07-10 18:24 ` [PATCH 4.9 28/52] ext4: always check block group bounds in ext4_init_block_bitmap() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 29/52] ext4: only look at the bg_flags field if it is valid Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 30/52] ext4: verify the depth of extent tree in ext4_find_extent() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.9 31/52] ext4: include the illegal physical block in the bad map ext4_error msg Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 32/52] ext4: clear i_data in ext4_inode_info when removing inline data Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 33/52] ext4: add more inode number paranoia checks Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 34/52] ext4: add more mount time checks of the superblock Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 35/52] ext4: check superblock mapped prior to committing Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 36/52] mlxsw: spectrum: Forbid linking of VLAN devices to devices that have uppers Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 37/52] HID: i2c-hid: Fix "incomplete report" noise Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 38/52] HID: hiddev: fix potential Spectre v1 Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 39/52] HID: debug: check length before copy_to_user() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 40/52] PM / OPP: Update voltage in case freq == old_freq Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 41/52] Kbuild: fix # escaping in .cmd files for future Make Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 42/52] media: cx25840: Use subdev host data for PLL override Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 43/52] mm, page_alloc: do not break __GFP_THISNODE by zonelist reset Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 44/52] dm bufio: avoid sleeping while holding the dm_bufio lock Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 45/52] dm bufio: drop the lock when doing GFP_NOIO allocation Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 46/52] mtd: rawnand: mxc: set spare area size register explicitly Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 47/52] dm bufio: dont take the lock in dm_bufio_shrink_count Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 48/52] mtd: cfi_cmdset_0002: Change definition naming to retry write operation Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 49/52] mtd: cfi_cmdset_0002: Change erase functions to retry for error Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 50/52] mtd: cfi_cmdset_0002: Change erase functions to check chip good only Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 51/52] netfilter: nf_log: dont hold nf_log_mutex during user access Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.9 52/52] staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() Greg Kroah-Hartman
2018-07-10 19:09 ` [PATCH 4.9 00/52] 4.9.112-stable review Nathan Chancellor
2018-07-11 11:04   ` Greg Kroah-Hartman
2018-07-11 11:17 ` Naresh Kamboju
2018-07-11 20:12   ` Dan Rue
2018-07-11 13:40 ` Guenter Roeck
2018-07-11 15:12 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180710182451.996275202@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).