diff options
| author | Jan Kara <jack@suse.cz> | 2020-11-02 16:16:29 +0100 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2020-11-03 11:17:00 +0100 |
| commit | 11c514a99bb960941535134f0587102855e8ddee (patch) | |
| tree | 86bdfabc4e8225cbe95a97486fcd8b303f7c414b /fs/quota/quota_v2.c | |
| parent | quota: Don't overflow quota file offsets (diff) | |
| download | linux-11c514a99bb960941535134f0587102855e8ddee.tar.xz linux-11c514a99bb960941535134f0587102855e8ddee.zip | |
quota: Sanity-check quota file headers on load
Perform basic sanity checks of quota headers to avoid kernel crashes on
corrupted quota files.
CC: stable@vger.kernel.org
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/quota/quota_v2.c')
| -rw-r--r-- | fs/quota/quota_v2.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c index e69a2bfdd81c..c21106557a37 100644 --- a/fs/quota/quota_v2.c +++ b/fs/quota/quota_v2.c @@ -157,6 +157,25 @@ static int v2_read_file_info(struct super_block *sb, int type) qinfo->dqi_entry_size = sizeof(struct v2r1_disk_dqblk); qinfo->dqi_ops = &v2r1_qtree_ops; } + ret = -EUCLEAN; + /* Some sanity checks of the read headers... */ + if ((loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits > + i_size_read(sb_dqopt(sb)->files[type])) { + quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).", + (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits, + i_size_read(sb_dqopt(sb)->files[type])); + goto out; + } + if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) { + quota_error(sb, "Free block number too big (%u >= %u).", + qinfo->dqi_free_blk, qinfo->dqi_blocks); + goto out; + } + if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) { + quota_error(sb, "Block with free entry too big (%u >= %u).", + qinfo->dqi_free_entry, qinfo->dqi_blocks); + goto out; + } ret = 0; out: up_read(&dqopt->dqio_sem); |