linux-kernel - [PATCH] f2fs: add sanity check for quota sysfile ino

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Jan 2018 16:29:33 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     <jaegeuk@...nel.org>
CC:     <linux-f2fs-devel@...ts.sourceforge.net>,
        <linux-kernel@...r.kernel.org>, <chao@...nel.org>,
        Chao Yu <yuchao0@...wei.com>
Subject: [PATCH] f2fs: add sanity check for quota sysfile ino

Add missing sanity check for quota sysfile ino.

Signed-off-by: Chao Yu <yuchao0@...wei.com>
---
 fs/f2fs/super.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 368f63d7bad2..6011071688ca 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2116,6 +2116,25 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
 		return 1;
 	}
 
+	/* check quota sysfile ino info */
+	if (raw_super->feature & cpu_to_le32(F2FS_FEATURE_QUOTA_INO)) {
+		if (le32_to_cpu(raw_super->qf_ino[0]) != 4 ||
+			le32_to_cpu(raw_super->qf_ino[1]) != 5) {
+			f2fs_msg(sb, KERN_INFO,
+				"Invalid Quota Ino: user_ino(%u), grp_ino(%u)",
+				le32_to_cpu(raw_super->qf_ino[0]),
+				le32_to_cpu(raw_super->qf_ino[1]));
+			return 1;
+		}
+		if (raw_super->feature & cpu_to_le32(F2FS_FEATURE_PRJQUOTA) &&
+			le32_to_cpu(raw_super->qf_ino[2]) != 6) {
+			f2fs_msg(sb, KERN_INFO,
+				"Invalid Quota Ino: prj_ino(%u)",
+				le32_to_cpu(raw_super->qf_ino[2]));
+			return 1;
+		}
+	}
+
 	if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) {
 		f2fs_msg(sb, KERN_INFO,
 			"Invalid segment count (%u)",
-- 
2.15.0.55.gc2ece9dc4de6