svn commit: r343512 - stable/12/sys/fs/ext2fs

[Pedro F. Giffuni]

Author: pfg
Date: Mon Jan 28 01:36:55 2019
New Revision: 343512
URL: https://svnweb.freebsd.org/changeset/base/343512

Log:
  MFC r343459:
  ext2fs: Add some extra consistency checks for the superblock.
  
  Maliciously formed, or badly corrupted, filesystems can cause kernel
  panics.  In general, such acts of foot-shooting can only be accomplished
  by root, but in a world with VM images that is  moving towards automated
  mounts it is important to have some form of prevention.
  
  Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert
  of Fraunhofer FKIE.
  Incidentaly this should also fix a memory corruption issue reported by
  Dr Silvio Cesare of InfoSect.
  
  Huge thanks to all reseachers for making us aware of the issue.
  
  admbug:		872, 891
  Reviewed by:	fsu
  Obtained from:	NetBSD (with minor changes)

Modified:
  stable/12/sys/fs/ext2fs/ext2_vfsops.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/fs/ext2fs/ext2_vfsops.c
==============================================================================
--- stable/12/sys/fs/ext2fs/ext2_vfsops.c	Mon Jan 28 01:28:17 2019	(r343511)
+++ stable/12/sys/fs/ext2fs/ext2_vfsops.c	Mon Jan 28 01:36:55 2019	(r343512)
@@ -416,7 +416,16 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es
 		    es->e3fs_desc_size);
 		return (EINVAL);
 	}
+	/* Check for block size = 1K|2K|4K */
+	if (es->e2fs_log_bsize > 2) {
+		printf("ext2fs: bad block size: %d\n", es->e2fs_log_bsize);
+		return (EINVAL);
+	}
 	/* Check for group size */
+	if (fs->e2fs_bpg == 0) {
+		printf("ext2fs: zero blocks per group\n");
+		return (EINVAL);
+	}
 	if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {
 		printf("ext2fs: non-standard group size unsupported %d\n",
 		    fs->e2fs_bpg);
@@ -424,7 +433,21 @@ compute_sb_data(struct vnode *devvp, struct ext2fs *es
 	}
 
 	fs->e2fs_ipb = fs->e2fs_bsize / EXT2_INODE_SIZE(fs);
+	if (fs->e2fs_ipg == 0) {
+		printf("ext2fs: zero inodes per group\n");
+		return (EINVAL);
+	}
 	fs->e2fs_itpg = fs->e2fs_ipg / fs->e2fs_ipb;
+	/* Check for block consistency */
+	if (es->e2fs_first_dblock >= fs->e2fs_bcount) {
+		printf("ext2fs: invalid first data block\n");
+		return (EINVAL);
+	}
+	if (fs->e2fs_rbcount > fs->e2fs_bcount ||
+	    fs->e2fs_fbcount > fs->e2fs_bcount) {
+		printf("ext2fs: invalid block count\n");
+		return (EINVAL);
+	}
 	/* s_resuid / s_resgid ? */
 	fs->e2fs_gcount = howmany(fs->e2fs_bcount - es->e2fs_first_dblock,
 	    EXT2_BLOCKS_PER_GROUP(fs));