ext2: Verify bitmap and itable block numbers before using them

Verify bitmap block numbers and inode table blocks are sane before using
them for checking bits in the block bitmap.

CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 1bfd6ab110389ad626da04af4e70d127c6f8798e..b8cfab8f98b97f35007b27a3e5d90107596fb4de 100644 (file)
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -77,26 +77,33 @@ static int ext2_valid_block_bitmap(struct super_block *sb,
        ext2_grpblk_t next_zero_bit;
        ext2_fsblk_t bitmap_blk;
        ext2_fsblk_t group_first_block;
+       ext2_grpblk_t max_bit;
 
        group_first_block = ext2_group_first_block_no(sb, block_group);
+       max_bit = ext2_group_last_block_no(sb, block_group) - group_first_block;
 
        /* check whether block bitmap block number is set */
        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
        offset = bitmap_blk - group_first_block;
-       if (!ext2_test_bit(offset, bh->b_data))
+       if (offset < 0 || offset > max_bit ||
+           !ext2_test_bit(offset, bh->b_data))
                /* bad block bitmap */
                goto err_out;
 
        /* check whether the inode bitmap block number is set */
        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
        offset = bitmap_blk - group_first_block;
-       if (!ext2_test_bit(offset, bh->b_data))
+       if (offset < 0 || offset > max_bit ||
+           !ext2_test_bit(offset, bh->b_data))
                /* bad block bitmap */
                goto err_out;
 
        /* check whether the inode table block number is set */
        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
        offset = bitmap_blk - group_first_block;
+       if (offset < 0 || offset > max_bit ||
+           offset + EXT2_SB(sb)->s_itb_per_group - 1 > max_bit)
+               goto err_out;
        next_zero_bit = ext2_find_next_zero_bit(bh->b_data,
                                offset + EXT2_SB(sb)->s_itb_per_group,
                                offset);