Commit 4ea99936 authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: add more paranoia checking in ext4_expand_extra_isize handling 

It's possible to specify a non-zero s_want_extra_isize via debugging
option, and this can cause bad things(tm) to happen when using a file
system with an inode size of 128 bytes.

Add better checking when the file system is mounted, as well as when
we are actually doing the trying to do the inode expansion.

Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu


Reported-by: default avatar <syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
parent 8d0d47ea

fs/ext4/inode.c

+15 −0
Original line number Diff line number Diff line
@@ -5569,8 +5569,23 @@ static int __ext4_expand_extra_isize(struct inode *inode, 
{

	struct ext4_inode *raw_inode;

	struct ext4_xattr_ibody_header *header;

	unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);

	struct ext4_inode_info *ei = EXT4_I(inode);

	int error;



	/* this was checked at iget time, but double check for good measure */

	if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||

	    (ei->i_extra_isize & 3)) {

		EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",

				 ei->i_extra_isize,

				 EXT4_INODE_SIZE(inode->i_sb));

		return -EFSCORRUPTED;

	}

	if ((new_extra_isize < ei->i_extra_isize) ||

	    (new_extra_isize < 4) ||

	    (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))

		return -EINVAL;	/* Should never happen */



	raw_inode = ext4_raw_inode(iloc);



	header = IHDR(inode, raw_inode);

fs/ext4/super.c

+12 −9
Original line number Diff line number Diff line
@@ -3545,12 +3545,15 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) 
{

	struct ext4_sb_info *sbi = EXT4_SB(sb);

	struct ext4_super_block *es = sbi->s_es;



	/* determine the minimum size of new large inodes, if present */

	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&

	    sbi->s_want_extra_isize == 0) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

	unsigned def_extra_isize = sizeof(struct ext4_inode) -

						EXT4_GOOD_OLD_INODE_SIZE;



	if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {

		sbi->s_want_extra_isize = 0;

		return;

	}

	if (sbi->s_want_extra_isize < 4) {

		sbi->s_want_extra_isize = def_extra_isize;

		if (ext4_has_feature_extra_isize(sb)) {

			if (sbi->s_want_extra_isize <

			    le16_to_cpu(es->s_want_extra_isize))
@@ -3563,10 +3566,10 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) 
		}

	}

	/* Check if enough inode space is available */

	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

							sbi->s_inode_size) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

						       EXT4_GOOD_OLD_INODE_SIZE;

	if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||

	    (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

							sbi->s_inode_size)) {

		sbi->s_want_extra_isize = def_extra_isize;

		ext4_msg(sb, KERN_INFO,

			 "required extra inode space not available");

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE