This prevents a kernel panic on a damaged ext2 superblock.
PR: 259107
Reported by: Robert Morris <rtm@lcs.mit.edu>
Differential D33029
ext2: Check for e2fs_first_dblock in ext2_compute_sb_data() nc on Nov 16 2021, 11:01 PM. Authored by Tags None Referenced Files
Subscribers
Details This prevents a kernel panic on a damaged ext2 superblock. PR: 259107 Test this patch with the nullfs in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259107
Diff Detail
Event TimelineComment Actions I have some good news, this works! With patch: root@fatbox:~ # mount -t ext2fs /dev/md0 /mnt mount: /dev/md0: Invalid argument root@fatbox:~ # Comment Actions The first data block value check should be more complex. See s_first_data_block superblock field here: Comment Actions This version of e2fs_first_dblock check will fail on 1k block size. The fs->e2fs->e2fs_bcount >= 1024 is always true. Ok, let's change e2fs_first_dblock check (ext2_vfsops.c, line 621) from: if (le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) { SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "first data block out of range"); return (EINVAL); } to if (le32toh(es->e2fs_first_dblock) != (fs->e2fs_bsize > 1024 ? 0 : 1) || le32toh(es->e2fs_first_dblock) >= fs->e2fs_bcount) { SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "first data block is invalid"); return (EINVAL); } |