Author: pfg
Date: Fri Jan 25 22:22:29 2019
New Revision: 343459
URL: https://svnweb.freebsd.org/changeset/base/343459
Log:
ext2fs: Add some extra consistency checks for the superblock.
Maliciously formed, or badly corrupted, filesystems can cause kernel
panics. In general, such acts of foot-shooting can only be accomplished
by root, but in a world with VM images that is moving towards automated
mounts it is important to have some form of prevention.
Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert
of Fraunhofer FKIE.
Incidentaly this should also fix a memory corruption issue reported by
Dr Silvio Cesare of InfoSect.
Huge thanks to all reseachers for making us aware of the issue.
admbug: 872, 891
Reviewed by: fsu
Obtained from: NetBSD (with minor changes)
MFC after: 3 days
Modified:
head/sys/fs/ext2fs/ext2_vfsops.c
Modified: head/sys/fs/ext2fs/ext2_vfsops.c
==============================================================================
--- head/sys/fs/ext2fs/ext2_vfsops.c Fri Jan 25 21:38:28 2019
(r343458)
+++ head/sys/fs/ext2fs/ext2_vfsops.c Fri Jan 25 22:22:29 2019
(r343459)
@@ -416,7 +416,16 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es
es->e3fs_desc_size);
return (EINVAL);
}
+ /* Check for block size = 1K|2K|4K */
+ if (es->e2fs_log_bsize > 2) {
+ printf("ext2fs: bad block size: %d\n", es->e2fs_log_bsize);
+ return (EINVAL);
+ }
/* Check for group size */
+ if (fs->e2fs_bpg == 0) {
+ printf("ext2fs: zero blocks per group\n");
+ return (EINVAL);
+ }
if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {
printf("ext2fs: non-standard group size unsupported %d\n",
fs->e2fs_bpg);
@@ -424,7 +433,21 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es
}
fs->e2fs_ipb = fs->e2fs_bsize / EXT2_INODE_SIZE(fs);
+ if (fs->e2fs_ipg == 0) {
+ printf("ext2fs: zero inodes per group\n");
+ return (EINVAL);
+ }
fs->e2fs_itpg = fs->e2fs_ipg / fs->e2fs_ipb;
+ /* Check for block consistency */
+ if (es->e2fs_first_dblock >= fs->e2fs_bcount) {
+ printf("ext2fs: invalid first data block\n");
+ return (EINVAL);
+ }
+ if (fs->e2fs_rbcount > fs->e2fs_bcount ||
+ fs->e2fs_fbcount > fs->e2fs_bcount) {
+ printf("ext2fs: invalid block count\n");
+ return (EINVAL);
+ }
/* s_resuid / s_resgid ? */
fs->e2fs_gcount = howmany(fs->e2fs_bcount - es->e2fs_first_dblock,
EXT2_BLOCKS_PER_GROUP(fs));
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
