svn commit: r350366 - stable/12/sys/fs/ext2fs

[Pedro F. Giffuni]

Author: pfg
Date: Fri Jul 26 21:08:01 2019
New Revision: 350366
URL: https://svnweb.freebsd.org/changeset/base/350366

Log:
  MFC r349802 (from fsu@):
  
  Add additional check for 'blocks per group' and 'fragments per group'
  superblock fields.
  
  These fields will not be equal only in case if bigalloc filesystem feature is
  turned on.  This feature is not supported for now.
  
  Reported by:    Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE
  Reported as:    FS-27-EXT2-12: Denial of Service in openat-0 (vm_fault_hold/ext2_clusteracct)

Modified:
  stable/12/sys/fs/ext2fs/ext2_vfsops.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/fs/ext2fs/ext2_vfsops.c
==============================================================================
--- stable/12/sys/fs/ext2fs/ext2_vfsops.c	Fri Jul 26 19:35:33 2019	(r350365)
+++ stable/12/sys/fs/ext2fs/ext2_vfsops.c	Fri Jul 26 21:08:01 2019	(r350366)
@@ -559,7 +559,12 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2f
 		SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
 		    "zero blocks/fragments per group");
 		return (EINVAL);
+	} else if (fs->e2fs_bpg != fs->e2fs_fpg) {
+		SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
+		    "blocks per group not equal fragments per group");
+		return (EINVAL);
 	}
+
 	if (fs->e2fs_bpg != fs->e2fs_bsize * 8) {
 		SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error,
 		    "non-standard group size unsupported");