ext4: check for invalid block size early when mounting a file system
authorTheodore Ts'o <tytso@mit.edu>
Wed, 9 Dec 2020 20:59:11 +0000 (15:59 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 6 Jan 2021 13:56:52 +0000 (14:56 +0100)
commit721972b8665f784f6d840d9ef563a8971565c569
tree3b56241f09c931966b7a8fc693100e7c141ebcf5
parent8ed894f1117e5e1347e059943480265e3f8480e3
ext4: check for invalid block size early when mounting a file system

commit c9200760da8a728eb9767ca41a956764b28c1310 upstream.

Check for valid block size directly by validating s_log_block_size; we
were doing this in two places.  First, by calculating blocksize via
BLOCK_SIZE << s_log_block_size, and then checking that the blocksize
was valid.  And then secondly, by checking s_log_block_size directly.

The first check is not reliable, and can trigger an UBSAN warning if
s_log_block_size on a maliciously corrupted superblock is greater than
22.  This is harmless, since the second test will correctly reject the
maliciously fuzzed file system, but to make syzbot shut up, and
because the two checks are duplicative in any case, delete the
blocksize check, and move the s_log_block_size earlier in
ext4_fill_super().

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: syzbot+345b75652b1d24227443@syzkaller.appspotmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ext4/super.c