Return-Path: Received: from mail-pl1-f194.google.com ([209.85.214.194]:36896 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727504AbeJEAsO (ORCPT ); Thu, 4 Oct 2018 20:48:14 -0400 Received: by mail-pl1-f194.google.com with SMTP id az3-v6so5543475plb.4 for ; Thu, 04 Oct 2018 10:53:53 -0700 (PDT) From: Greg Hackmann To: stable@vger.kernel.org Cc: Theodore Ts'o , Ben Hutchings , Greg Hackmann Subject: [PATCH 3.18.y 04/10] ext4: fix false negatives *and* false positives in ext4_check_descriptors() Date: Thu, 4 Oct 2018 10:53:14 -0700 Message-Id: <20181004175320.181881-5-ghackmann@google.com> In-Reply-To: <20181004175320.181881-1-ghackmann@google.com> References: <20181004175320.181881-1-ghackmann@google.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: From: Theodore Ts'o commit 44de022c4382541cebdd6de4465d1f4f465ff1dd upstream. Ext4_check_descriptors() was getting called before s_gdb_count was initialized. So for file systems w/o the meta_bg feature, allocation bitmaps could overlap the block group descriptors and ext4 wouldn't notice. For file systems with the meta_bg feature enabled, there was a fencepost error which would cause the ext4_check_descriptors() to incorrectly believe that the block allocation bitmap overlaps with the block group descriptor blocks, and it would reject the mount. Fix both of these problems. Signed-off-by: Theodore Ts'o [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Hackmann --- fs/ext4/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 91740af5648e..6806b8937803 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -2064,7 +2064,7 @@ static int ext4_check_descriptors(struct super_block *sb, struct ext4_sb_info *sbi = EXT4_SB(sb); ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block); ext4_fsblk_t last_block; - ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1; + ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0); ext4_fsblk_t block_bitmap; ext4_fsblk_t inode_bitmap; ext4_fsblk_t inode_table; @@ -4018,12 +4018,12 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) goto failed_mount2; } } + sbi->s_gdb_count = db_count; if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); goto failed_mount2; } - sbi->s_gdb_count = db_count; get_random_bytes(&sbi->s_next_generation, sizeof(u32)); spin_lock_init(&sbi->s_next_gen_lock); -- 2.19.0.605.g01d371f741-goog