linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Theodore Tso <tytso@mit.edu>,
	stable@kernel.org
Subject: [PATCH 4.14 18/53] ext4: make sure bitmaps and the inode table dont overlap with bg descriptors
Date: Tue, 10 Jul 2018 20:24:54 +0200	[thread overview]
Message-ID: <20180710182459.936814484@linuxfoundation.org> (raw)
In-Reply-To: <20180710182458.736721865@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 77260807d1170a8cf35dbb06e07461a655f67eee upstream.

It's really bad when the allocation bitmaps and the inode table
overlap with the block group descriptors, since it causes random
corruption of the bg descriptors.  So we really want to head those off
at the pass.

https://bugzilla.kernel.org/show_bug.cgi?id=199865

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/super.c |   25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2301,6 +2301,7 @@ static int ext4_check_descriptors(struct
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
 	ext4_fsblk_t last_block;
+	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
 	ext4_fsblk_t block_bitmap;
 	ext4_fsblk_t inode_bitmap;
 	ext4_fsblk_t inode_table;
@@ -2333,6 +2334,14 @@ static int ext4_check_descriptors(struct
 			if (!sb_rdonly(sb))
 				return 0;
 		}
+		if (block_bitmap >= sb_block + 1 &&
+		    block_bitmap <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Block bitmap for group %u overlaps "
+				 "block group descriptors", i);
+			if (!sb_rdonly(sb))
+				return 0;
+		}
 		if (block_bitmap < first_block || block_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Block bitmap for group %u not in group "
@@ -2347,6 +2356,14 @@ static int ext4_check_descriptors(struct
 			if (!sb_rdonly(sb))
 				return 0;
 		}
+		if (inode_bitmap >= sb_block + 1 &&
+		    inode_bitmap <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode bitmap for group %u overlaps "
+				 "block group descriptors", i);
+			if (!sb_rdonly(sb))
+				return 0;
+		}
 		if (inode_bitmap < first_block || inode_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Inode bitmap for group %u not in group "
@@ -2361,6 +2378,14 @@ static int ext4_check_descriptors(struct
 			if (!sb_rdonly(sb))
 				return 0;
 		}
+		if (inode_table >= sb_block + 1 &&
+		    inode_table <= last_bg_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode table for group %u overlaps "
+				 "block group descriptors", i);
+			if (!sb_rdonly(sb))
+				return 0;
+		}
 		if (inode_table < first_block ||
 		    inode_table + sbi->s_itb_per_group - 1 > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "



  parent reply	other threads:[~2018-07-10 18:32 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-10 18:24 [PATCH 4.14 00/53] 4.14.55-stable review Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 01/53] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 02/53] mm: hugetlb: yield when prepping struct pages Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 03/53] tracing: Fix missing return symbol in function_graph output Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 04/53] scsi: sg: mitigate read/write abuse Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 05/53] scsi: target: Fix truncated PR-in ReadKeys response Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 06/53] s390: Correct register corruption in critical section cleanup Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 07/53] drbd: fix access after free Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 08/53] vfio: Use get_user_pages_longterm correctly Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 09/53] cifs: Fix use after free of a mid_q_entry Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 10/53] cifs: Fix memory leak in smb2_set_ea() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 11/53] cifs: Fix infinite loop when using hard mount option Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 12/53] cifs: Fix slab-out-of-bounds in send_set_info() on SMB2 ACE setting Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 13/53] drm: Use kvzalloc for allocating blob property memory Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 14/53] drm/udl: fix display corruption of the last line Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 15/53] jbd2: dont mark block as modified if the handle is out of credits Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 16/53] ext4: add corruption check in ext4_xattr_set_entry() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 17/53] ext4: always verify the magic number in xattr blocks Greg Kroah-Hartman
2018-07-10 18:24 ` Greg Kroah-Hartman [this message]
2018-07-10 18:24 ` [PATCH 4.14 19/53] ext4: always check block group bounds in ext4_init_block_bitmap() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 20/53] ext4: only look at the bg_flags field if it is valid Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 21/53] ext4: verify the depth of extent tree in ext4_find_extent() Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 22/53] ext4: include the illegal physical block in the bad map ext4_error msg Greg Kroah-Hartman
2018-07-10 18:24 ` [PATCH 4.14 23/53] ext4: clear i_data in ext4_inode_info when removing inline data Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 24/53] ext4: never move the system.data xattr out of the inode body Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 25/53] ext4: avoid running out of journal credits when appending to an inline file Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 26/53] ext4: add more inode number paranoia checks Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 27/53] ext4: add more mount time checks of the superblock Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 28/53] ext4: check superblock mapped prior to committing Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 29/53] block: factor out __blkdev_issue_zero_pages() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 30/53] block: cope with WRITE ZEROES failing in blkdev_issue_zeroout() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 31/53] HID: i2c-hid: Fix "incomplete report" noise Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 32/53] HID: hiddev: fix potential Spectre v1 Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 33/53] HID: debug: check length before copy_to_user() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 34/53] irq/core: Fix boot crash when the irqaffinity= boot parameter is passed on CPUMASK_OFFSTACK=y kernels(v1) Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 35/53] mm: hwpoison: disable memory error handling on 1GB hugepage Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 36/53] media: vb2: core: Finish buffers at the end of the stream Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 37/53] f2fs: truncate preallocated blocks in error case Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 38/53] [PATCH] Revert "dpaa_eth: fix error in dpaa_remove()" Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 39/53] Kbuild: fix # escaping in .cmd files for future Make Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 40/53] media: cx25840: Use subdev host data for PLL override Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 41/53] mtd: rawnand: mxc: set spare area size register explicitly Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 42/53] fs: allow per-device dax status checking for filesystems Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 43/53] dax: change bdev_dax_supported() to support boolean returns Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 44/53] dax: check for QUEUE_FLAG_DAX in bdev_dax_supported() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 45/53] dm: set QUEUE_FLAG_DAX accordingly in dm_table_set_restrictions() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 46/53] dm: prevent DAX mounts if not supported Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 47/53] mtd: cfi_cmdset_0002: Change definition naming to retry write operation Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 48/53] mtd: cfi_cmdset_0002: Change erase functions to retry for error Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 49/53] mtd: cfi_cmdset_0002: Change erase functions to check chip good only Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 50/53] netfilter: nf_log: dont hold nf_log_mutex during user access Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 51/53] staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write() Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 52/53] sched, tracing: Fix trace_sched_pi_setprio() for deboosting Greg Kroah-Hartman
2018-07-10 18:25 ` [PATCH 4.14 53/53] Revert mm/vmstat.c: fix vmstat_update() preemption BUG Greg Kroah-Hartman
2018-07-11 13:05 ` [PATCH 4.14 00/53] 4.14.55-stable review Naresh Kamboju
2018-07-11 13:41 ` Guenter Roeck
2018-07-11 15:20 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180710182459.936814484@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).