linux-ext4 - Re: [PATCH] ext4: Forbid overflowing inode count when resizing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 May 2018 10:44:15 -0600
From:   Andreas Dilger <adilger@...ger.ca>
To:     Jan Kara <jack@...e.cz>
Cc:     Ted Tso <tytso@....edu>,
        Ext4 Developers List <linux-ext4@...r.kernel.org>,
        Jaco Kroon <jaco@....co.za>, stable@...r.kernel.org
Subject: Re: [PATCH] ext4: Forbid overflowing inode count when resizing

On May 24, 2018, at 5:36 AM, Jan Kara <jack@...e.cz> wrote:
> 
> ext4_resize_fs() has an off-by-one bug when checking whether growing of
> a filesystem will not overflow inode count. As a result it allows a
> filesystem with 8192 inodes per group to grow to 64TB which overflows
> inode count to 0 and makes filesystem unusable. Fix it.
> 
> CC: stable@...r.kernel.org
> Fixes: 3f8a6411fbada1fa482276591e037f3b1adcf55b
> Reported-by: Jaco Kroon <jaco@....co.za>
> Signed-off-by: Jan Kara <jack@...e.cz>

This should be enough to stop the filesystem from exploding.
We can look at more complex solutions in a separate patch.

Reviewed-by: Andreas Dilger <adilger@...ger.ca>

> ---
> fs/ext4/resize.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
> index b6bec270a8e4..d792b7689d92 100644
> --- a/fs/ext4/resize.c
> +++ b/fs/ext4/resize.c
> @@ -1933,7 +1933,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
> 		return 0;
> 
> 	n_group = ext4_get_group_number(sb, n_blocks_count - 1);
> -	if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
> +	if (n_group >= (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
> 		ext4_warning(sb, "resize would cause inodes_count overflow");
> 		return -EINVAL;
> 	}
> --
> 2.13.6
> 


Cheers, Andreas






Download attachment "signature.asc" of type "application/pgp-signature" (874 bytes)