diff options
author | Jin Qian | 2017-05-15 12:45:08 -0500 |
---|---|---|
committer | Greg Kroah-Hartman | 2017-08-11 11:08:51 -0500 |
commit | 76517ed2a7fe059840c1984165984e69cb488568 (patch) | |
tree | a5b28f4be15cd320d961ff2e1bea79c84ce9cf7c /fs | |
parent | c7c6f63dbc676788f0cb5a804dff57a0639af446 (diff) | |
download | kernel-omap-76517ed2a7fe059840c1984165984e69cb488568.tar.gz kernel-omap-76517ed2a7fe059840c1984165984e69cb488568.tar.xz kernel-omap-76517ed2a7fe059840c1984165984e69cb488568.zip |
f2fs: sanity check checkpoint segno and blkoff
commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream.
Make sure segno and blkoff read from raw image are valid.
Cc: stable@vger.kernel.org
Signed-off-by: Jin Qian <jinqian@google.com>
[Jaegeuk Kim: adjust minor coding style]
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[AmitP: Found in Android Security bulletin for Aug'17, fixes CVE-2017-10663]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/f2fs/super.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 86e1cb899957..4f666368aa85 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c | |||
@@ -1078,6 +1078,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) | |||
1078 | unsigned int total, fsmeta; | 1078 | unsigned int total, fsmeta; |
1079 | struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); | 1079 | struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); |
1080 | struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); | 1080 | struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); |
1081 | unsigned int main_segs, blocks_per_seg; | ||
1082 | int i; | ||
1081 | 1083 | ||
1082 | total = le32_to_cpu(raw_super->segment_count); | 1084 | total = le32_to_cpu(raw_super->segment_count); |
1083 | fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); | 1085 | fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); |
@@ -1089,6 +1091,20 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) | |||
1089 | if (unlikely(fsmeta >= total)) | 1091 | if (unlikely(fsmeta >= total)) |
1090 | return 1; | 1092 | return 1; |
1091 | 1093 | ||
1094 | main_segs = le32_to_cpu(raw_super->segment_count_main); | ||
1095 | blocks_per_seg = sbi->blocks_per_seg; | ||
1096 | |||
1097 | for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) { | ||
1098 | if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs || | ||
1099 | le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg) | ||
1100 | return 1; | ||
1101 | } | ||
1102 | for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) { | ||
1103 | if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs || | ||
1104 | le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg) | ||
1105 | return 1; | ||
1106 | } | ||
1107 | |||
1092 | if (unlikely(f2fs_cp_error(sbi))) { | 1108 | if (unlikely(f2fs_cp_error(sbi))) { |
1093 | f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); | 1109 | f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); |
1094 | return 1; | 1110 | return 1; |