Commit 6dbab50c authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Luis Henriques

jbd2: fix r_count overflows leading to buffer overflow in journal recovery

commit e531d0bc upstream.

The journal revoke block recovery code does not check r_count for
sanity, which means that an evil value of r_count could result in
the kernel reading off the end of the revoke table and into whatever
garbage lies beyond.  This could crash the kernel, so fix that.

However, in testing this fix, I discovered that the code to write
out the revoke tables also was not correctly checking to see if the
block was full -- the current offset check is fine so long as the
revoke table space size is a multiple of the record size, but this
is not true when either journal_csum_v[23] are set.
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 30d8953f
...@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, ...@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
{ {
jbd2_journal_revoke_header_t *header; jbd2_journal_revoke_header_t *header;
int offset, max; int offset, max;
int csum_size = 0;
__u32 rcount;
int record_len = 4; int record_len = 4;
header = (jbd2_journal_revoke_header_t *) bh->b_data; header = (jbd2_journal_revoke_header_t *) bh->b_data;
offset = sizeof(jbd2_journal_revoke_header_t); offset = sizeof(jbd2_journal_revoke_header_t);
max = be32_to_cpu(header->r_count); rcount = be32_to_cpu(header->r_count);
if (!jbd2_revoke_block_csum_verify(journal, header)) if (!jbd2_revoke_block_csum_verify(journal, header))
return -EINVAL; return -EINVAL;
if (jbd2_journal_has_csum_v2or3(journal))
csum_size = sizeof(struct jbd2_journal_revoke_tail);
if (rcount > journal->j_blocksize - csum_size)
return -EINVAL;
max = rcount;
if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
record_len = 8; record_len = 8;
......
...@@ -583,7 +583,7 @@ static void write_one_revoke_record(journal_t *journal, ...@@ -583,7 +583,7 @@ static void write_one_revoke_record(journal_t *journal,
{ {
int csum_size = 0; int csum_size = 0;
struct buffer_head *descriptor; struct buffer_head *descriptor;
int offset; int sz, offset;
journal_header_t *header; journal_header_t *header;
/* If we are already aborting, this all becomes a noop. We /* If we are already aborting, this all becomes a noop. We
...@@ -600,9 +600,14 @@ static void write_one_revoke_record(journal_t *journal, ...@@ -600,9 +600,14 @@ static void write_one_revoke_record(journal_t *journal,
if (jbd2_journal_has_csum_v2or3(journal)) if (jbd2_journal_has_csum_v2or3(journal))
csum_size = sizeof(struct jbd2_journal_revoke_tail); csum_size = sizeof(struct jbd2_journal_revoke_tail);
if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
sz = 8;
else
sz = 4;
/* Make sure we have a descriptor with space left for the record */ /* Make sure we have a descriptor with space left for the record */
if (descriptor) { if (descriptor) {
if (offset >= journal->j_blocksize - csum_size) { if (offset + sz > journal->j_blocksize - csum_size) {
flush_descriptor(journal, descriptor, offset, write_op); flush_descriptor(journal, descriptor, offset, write_op);
descriptor = NULL; descriptor = NULL;
} }
...@@ -625,16 +630,13 @@ static void write_one_revoke_record(journal_t *journal, ...@@ -625,16 +630,13 @@ static void write_one_revoke_record(journal_t *journal,
*descriptorp = descriptor; *descriptorp = descriptor;
} }
if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) { if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
* ((__be64 *)(&descriptor->b_data[offset])) = * ((__be64 *)(&descriptor->b_data[offset])) =
cpu_to_be64(record->blocknr); cpu_to_be64(record->blocknr);
offset += 8; else
} else {
* ((__be32 *)(&descriptor->b_data[offset])) = * ((__be32 *)(&descriptor->b_data[offset])) =
cpu_to_be32(record->blocknr); cpu_to_be32(record->blocknr);
offset += 4; offset += sz;
}
*offsetp = offset; *offsetp = offset;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment