Message-ID: <d2a5be55-4bcb-da7e-fae5-9cc598223b17@linaro.org>
Date:   Wed, 1 Mar 2023 11:37:20 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
Subject: Re: [PATCH 2/2] ext2: Check block size validity during mount
Content-Language: en-US
To:     Jan Kara <jack@suse.cz>, linux-ext4@vger.kernel.org
Cc:     syzbot+4fec412f59eba8c01b77@syzkaller.appspotmail.com
References: <20230301111026.15102-1-jack@suse.cz>
 <20230301111238.22856-2-jack@suse.cz>
From:   Tudor Ambarus <tudor.ambarus@linaro.org>
In-Reply-To: <20230301111238.22856-2-jack@suse.cz>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi!

On 3/1/23 11:12, Jan Kara wrote:
> Check that log of block size stored in the superblock has sensible
> value. Otherwise the shift computing the block size can overflow leading
> to undefined behavior.
> 
> Reported-by: syzbot+4fec412f59eba8c01b77@syzkaller.appspotmail.com

Would be helpful to also have:
LINK: https://syzkaller.appspot.com/bug?extid=4fec412f59eba8c01b77
a "Fixes:" tag and
Cc: stable@vger.kernel.org

Cheers,
ta

> Signed-off-by: Jan Kara <jack@suse.cz>
> ---
>   fs/ext2/ext2.h  | 1 +
>   fs/ext2/super.c | 7 +++++++
>   2 files changed, 8 insertions(+)
> 
> diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
> index 6c8e838bb278..8244366862e4 100644
> --- a/fs/ext2/ext2.h
> +++ b/fs/ext2/ext2.h
> @@ -180,6 +180,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb)
>   #define EXT2_MIN_BLOCK_SIZE		1024
>   #define	EXT2_MAX_BLOCK_SIZE		65536
>   #define EXT2_MIN_BLOCK_LOG_SIZE		  10
> +#define EXT2_MAX_BLOCK_LOG_SIZE		  16
>   #define EXT2_BLOCK_SIZE(s)		((s)->s_blocksize)
>   #define	EXT2_ADDR_PER_BLOCK(s)		(EXT2_BLOCK_SIZE(s) / sizeof (__u32))
>   #define EXT2_BLOCK_SIZE_BITS(s)		((s)->s_blocksize_bits)
> diff --git a/fs/ext2/super.c b/fs/ext2/super.c
> index 69c88facfe90..f342f347a695 100644
> --- a/fs/ext2/super.c
> +++ b/fs/ext2/super.c
> @@ -945,6 +945,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
>   		goto failed_mount;
>   	}
>   
> +	if (le32_to_cpu(es->s_log_block_size) >
> +	    (EXT2_MAX_BLOCK_LOG_SIZE - BLOCK_SIZE_BITS)) {
> +		ext2_msg(sb, KERN_ERR,
> +			 "Invalid log block size: %u",
> +			 le32_to_cpu(es->s_log_block_size));
> +		goto failed_mount;
> +	}
>   	blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
>   
>   	if (test_opt(sb, DAX)) {