aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorJin Qian2017-05-15 12:45:08 -0500
committerGreg Kroah-Hartman2017-08-11 11:08:51 -0500
commit76517ed2a7fe059840c1984165984e69cb488568 (patch)
treea5b28f4be15cd320d961ff2e1bea79c84ce9cf7c /fs
parentc7c6f63dbc676788f0cb5a804dff57a0639af446 (diff)
downloadkernel-omap-76517ed2a7fe059840c1984165984e69cb488568.tar.gz
kernel-omap-76517ed2a7fe059840c1984165984e69cb488568.tar.xz
kernel-omap-76517ed2a7fe059840c1984165984e69cb488568.zip
f2fs: sanity check checkpoint segno and blkoff
commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream. Make sure segno and blkoff read from raw image are valid. Cc: stable@vger.kernel.org Signed-off-by: Jin Qian <jinqian@google.com> [Jaegeuk Kim: adjust minor coding style] Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> [AmitP: Found in Android Security bulletin for Aug'17, fixes CVE-2017-10663] Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/f2fs/super.c16
1 files changed, 16 insertions, 0 deletions
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 86e1cb899957..4f666368aa85 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1078,6 +1078,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi)
1078 unsigned int total, fsmeta; 1078 unsigned int total, fsmeta;
1079 struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); 1079 struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
1080 struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); 1080 struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
1081 unsigned int main_segs, blocks_per_seg;
1082 int i;
1081 1083
1082 total = le32_to_cpu(raw_super->segment_count); 1084 total = le32_to_cpu(raw_super->segment_count);
1083 fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); 1085 fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
@@ -1089,6 +1091,20 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi)
1089 if (unlikely(fsmeta >= total)) 1091 if (unlikely(fsmeta >= total))
1090 return 1; 1092 return 1;
1091 1093
1094 main_segs = le32_to_cpu(raw_super->segment_count_main);
1095 blocks_per_seg = sbi->blocks_per_seg;
1096
1097 for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
1098 if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
1099 le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)
1100 return 1;
1101 }
1102 for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
1103 if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
1104 le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
1105 return 1;
1106 }
1107
1092 if (unlikely(f2fs_cp_error(sbi))) { 1108 if (unlikely(f2fs_cp_error(sbi))) {
1093 f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); 1109 f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
1094 return 1; 1110 return 1;