ext2: Check block size validity during mount

[ Upstream commit 62aeb94433fcec80241754b70d0d1836d5926b0a ]

Check that log of block size stored in the superblock has sensible
value. Otherwise the shift computing the block size can overflow leading
to undefined behavior.

Reported-by: syzbot+4fec412f59eba8c01b77@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index 032295e1d3865383342f843b99b4c2c0e972078c..b500fed96a692389d6c73be5874ab65b1b69c404 100644 (file)
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -177,6 +177,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb)
 #define EXT2_MIN_BLOCK_SIZE            1024
 #define        EXT2_MAX_BLOCK_SIZE             4096
 #define EXT2_MIN_BLOCK_LOG_SIZE                  10
+#define EXT2_MAX_BLOCK_LOG_SIZE                  16
 #define EXT2_BLOCK_SIZE(s)             ((s)->s_blocksize)
 #define        EXT2_ADDR_PER_BLOCK(s)          (EXT2_BLOCK_SIZE(s) / sizeof (__u32))
 #define EXT2_BLOCK_SIZE_BITS(s)                ((s)->s_blocksize_bits)

diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 5f7079b65426c5a50abf7f68eda5580c12f289ae..7ca9fb0bfc324b6ea2b9134f789eac8f8458228f 100644 (file)
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -965,6 +965,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
                goto failed_mount;
        }
 
+       if (le32_to_cpu(es->s_log_block_size) >
+           (EXT2_MAX_BLOCK_LOG_SIZE - BLOCK_SIZE_BITS)) {
+               ext2_msg(sb, KERN_ERR,
+                        "Invalid log block size: %u",
+                        le32_to_cpu(es->s_log_block_size));
+               goto failed_mount;
+       }
        blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
 
        if (sbi->s_mount_opt & EXT2_MOUNT_DAX) {