linux/fs/ext4
Eric Sandeen e7c9559300 ext4: fix oops on corrupted ext4 mount
When mounting an ext4 filesystem with corrupted s_first_data_block, things
can go very wrong and oops.

Because blocks_count in ext4_fill_super is a u64, and we must use do_div,
the calculation of db_count is done differently than on ext4.  If
first_data_block is corrupted such that it is larger than ext4_blocks_count,
for example, then the intermediate blocks_count value may go negative,
but sign-extend to a very large value:

        blocks_count = (ext4_blocks_count(es) -
                        le32_to_cpu(es->s_first_data_block) +
                        EXT4_BLOCKS_PER_GROUP(sb) - 1);

This is then assigned to s_groups_count which is an unsigned long:

        sbi->s_groups_count = blocks_count;

This may result in a value of 0xFFFFFFFF which is then used to compute
db_count:

        db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
                   EXT4_DESC_PER_BLOCK(sb);

and in this case db_count will wind up as 0 because the addition overflows
32 bits.  This in turn causes the kmalloc for group_desc to be of 0 size:

        sbi->s_group_desc = kmalloc(db_count * sizeof (struct buffer_head *),
                                    GFP_KERNEL);

and eventually in ext4_check_descriptors, dereferencing
sbi->s_group_desc[desc_block] will result in a NULL pointer dereference.

The simplest test seems to be to sanity check s_first_data_block,
EXT4_BLOCKS_PER_GROUP, and ext4_blocks_count values to be sure
their combination won't result in a bad intermediate value for
blocks_count.  We could just check for db_count == 0, but
catching it at the root cause seems like it provides more info.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mingming Cao <cmm@us.ibm.com>
2008-01-28 23:58:27 -05:00
..
acl.c Introduce is_owner_or_cap() to wrap CAP_FOWNER use with fsuid check 2007-07-17 12:00:03 -07:00
acl.h [PATCH] ext4: rename ext4 symbols to avoid duplication of ext3 symbols 2006-10-11 11:14:15 -07:00
balloc.c ext4: Return after ext4_error in case of failures 2008-01-28 23:58:27 -05:00
bitmap.c fs: mark nibblemap const 2007-10-17 08:42:47 -07:00
dir.c ext4: Introduce ext4_lblk_t 2008-01-28 23:58:27 -05:00
ext4_jbd2.c [PATCH] ext4: uninline large functions 2006-12-07 08:39:35 -08:00
extents.c ext4: Fix sparse warnings. 2008-01-28 23:58:27 -05:00
file.c ext4: store maxbytes for bitmapped files and return EFBIG as appropriate 2008-01-28 23:58:27 -05:00
fsync.c ext4: sparse fixes 2007-10-17 18:50:03 -04:00
group.h ext4: add ext4_group_t, and change all group variables to this type. 2008-01-28 23:58:27 -05:00
hash.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
ialloc.c ext4: Rename i_dir_acl to i_size_high 2008-01-28 23:58:27 -05:00
inode.c ext4: store maxbytes for bitmapped files and return EFBIG as appropriate 2008-01-28 23:58:27 -05:00
ioctl.c Forbid user to change file flags on quota files 2007-11-14 18:45:38 -08:00
Makefile [PATCH] ext4: uninline large functions 2006-12-07 08:39:35 -08:00
namei.c ext4: Introduce ext4_lblk_t 2008-01-28 23:58:27 -05:00
namei.h [PATCH] ext4: rename ext4 symbols to avoid duplication of ext3 symbols 2006-10-11 11:14:15 -07:00
resize.c ext4: add ext4_group_t, and change all group variables to this type. 2008-01-28 23:58:27 -05:00
super.c ext4: fix oops on corrupted ext4 mount 2008-01-28 23:58:27 -05:00
symlink.c [PATCH] mark struct inode_operations const 1 2007-02-12 09:48:46 -08:00
xattr_security.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr_trusted.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr_user.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr.c ext4: sparse fixes 2007-10-17 18:50:03 -04:00
xattr.h ext4: Expand extra_inodes space per the s_{want,min}_extra_isize fields 2007-07-18 09:19:57 -04:00