Skip to contentSkip to conversation

Patch "ext4: sanity check the block and cluster size at mount time" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Nov 21, 2016

Subsystems (2)
Stable branch ext4 file system
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ext4: sanity check the block and cluster size at mount time

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ext4-sanity-check-the-block-and-cluster-size-at-mount-time.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 8cdf3372fe8368f56315e66bea9f35053c418093 Mon Sep 17 00:00:00 2001

From: Theodore Ts'o <[email protected]>
Date: Fri, 18 Nov 2016 13:00:24 -0500
Subject: ext4: sanity check the block and cluster size at mount time

From: Theodore Ts'o <[email protected]>

commit 8cdf3372fe8368f56315e66bea9f35053c418093 upstream.

If the block size or cluster size is insane, reject the mount. This is important for security reasons (although we shouldn't be just depending on this check).

Ref: http://www.securityfocus.com/archive/1/539661
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1332506

Reported-by Borislav Petkov <[email protected]>
Reported-by Nikolay Borisov <[email protected]>
Signed-off-by Theodore Ts'o <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/ext4/ext4.h  |    1 +
 fs/ext4/super.c |   17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
fs/ext4/ext4.h +1 -0
@@ -221,6 +221,7 @@ struct ext4_io_submit {
 #define	EXT4_MAX_BLOCK_SIZE		65536
 #define EXT4_MIN_BLOCK_LOG_SIZE		10
 #define EXT4_MAX_BLOCK_LOG_SIZE		16
+#define EXT4_MAX_CLUSTER_LOG_SIZE	30
 #ifdef __KERNEL__
 # define EXT4_BLOCK_SIZE(s)		((s)->s_blocksize)
 #else
fs/ext4/super.c +16 -1
@@ -3394,7 +3394,15 @@ static int ext4_fill_super(struct super_
 	if (blocksize < EXT4_MIN_BLOCK_SIZE ||
 	    blocksize > EXT4_MAX_BLOCK_SIZE) {
 		ext4_msg(sb, KERN_ERR,
-		       "Unsupported filesystem blocksize %d", blocksize);
+		       "Unsupported filesystem blocksize %d (%d log_block_size)",
+			 blocksize, le32_to_cpu(es->s_log_block_size));
+		goto failed_mount;
+	}
+	if (le32_to_cpu(es->s_log_block_size) >
+	    (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+		ext4_msg(sb, KERN_ERR,
+			 "Invalid log block size: %u",
+			 le32_to_cpu(es->s_log_block_size));
 		goto failed_mount;
 	}
 

@@ -3533,6 +3541,13 @@ static int ext4_fill_super(struct super_
 				 "block size (%d)", clustersize, blocksize);
 			goto failed_mount;
 		}
+		if (le32_to_cpu(es->s_log_cluster_size) >
+		    (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+			ext4_msg(sb, KERN_ERR,
+				 "Invalid log cluster size: %u",
+				 le32_to_cpu(es->s_log_cluster_size));
+			goto failed_mount;
+		}
 		sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) -
 			le32_to_cpu(es->s_log_block_size);
 		sbi->s_clusters_per_group =

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ext4-sanity-check-the-block-and-cluster-size-at-mount-time.patch