From 6ce04e595a62a470079bc2c7ace3ab61dfe2d593 Mon Sep 17 00:00:00 2001 From: Fedor Uporov Date: Sun, 7 Jul 2019 08:58:02 +0000 Subject: [PATCH] Add additional check for 'blocks per group' and 'fragments per group' superblock fields. These fields will not be equal only in case if bigalloc filesystem feature is turned on. This feature is not supported for now. Reported by: Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE Reported as: FS-27-EXT2-12: Denial of Service in openat-0 (vm_fault_hold/ext2_clusteracct) MFC after: 2 weeks --- sys/fs/ext2fs/ext2_vfsops.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/fs/ext2fs/ext2_vfsops.c b/sys/fs/ext2fs/ext2_vfsops.c index d676aaf9eef..7f9c9690d8a 100644 --- a/sys/fs/ext2fs/ext2_vfsops.c +++ b/sys/fs/ext2fs/ext2_vfsops.c @@ -559,7 +559,12 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es, SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "zero blocks/fragments per group"); return (EINVAL); + } else if (fs->e2fs_bpg != fs->e2fs_fpg) { + SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, + "blocks per group not equal fragments per group"); + return (EINVAL); } + if (fs->e2fs_bpg != fs->e2fs_bsize * 8) { SDT_PROBE1(ext2fs, , vfsops, ext2_compute_sb_data_error, "non-standard group size unsupported");