android_kernel_samsung_msm8976/fs
Lukas Czerner 2fd7da79af ext4: fix bitmap position validation
commit 22be37acce25d66ecf6403fc8f44df9c5ded2372 upstream.

Currently in ext4_valid_block_bitmap() we expect the bitmap to be
positioned anywhere between 0 and s_blocksize clusters, but that's
wrong because the bitmap can be placed anywhere in the block group. This
causes false positives when validating bitmaps on perfectly valid file
system layouts. Fix it by checking whether the bitmap is within the group
boundary.

The problem can be reproduced using the following

mkfs -t ext3 -E stride=256 /dev/vdb1
mount /dev/vdb1 /mnt/test
cd /mnt/test
wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.16.3.tar.xz
tar xf linux-4.16.3.tar.xz

This will result in the warnings in the logs

EXT4-fs error (device vdb1): ext4_validate_block_bitmap:399: comm tar: bg 84: block 2774529: invalid block bitmap

[ Changed slightly for clarity and to not drop a overflow test -- TYT ]

Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Ilya Dryomov <idryomov@gmail.com>
Fixes: 7dac4a1726a9 ("ext4: add validity checks for bitmap block numbers")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
2019-07-27 21:49:52 +02:00
..
9p Merge tag 'LA.BR.1.3.6-03910-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2017-05-26 13:28:48 +02:00
adfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
affs This is the 3.10.84 stable release 2015-09-30 13:25:40 +05:30
afs
autofs4 move d_rcu from overlapping d_child to overlapping d_alias 2015-04-29 10:34:00 +02:00
befs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
bfs
btrfs Merge tag 'LA.BR.1.3.6-03910-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2017-05-26 13:28:48 +02:00
cachefiles
ceph move d_rcu from overlapping d_child to overlapping d_alias 2015-04-29 10:34:00 +02:00
cifs This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
coda This is the 3.10.84 stable release 2015-09-30 13:25:40 +05:30
configfs
cramfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
crypto fscrypt: catch up to v4.11-rc1 2017-03-09 11:48:12 -08:00
debugfs BACKPORT: dentry name snapshots 2017-12-22 20:25:56 +00:00
devpts This is the 3.10.98 stable release 2017-04-18 17:17:24 +02:00
dlm
ecryptfs fs: ecryptfs: Checkout to LA.BR.1.3.6-04510-8976.0 2018-02-06 13:12:17 +01:00
efivarfs efi: Make efivarfs entries immutable by default 2016-03-16 08:41:37 -07:00
efs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
exfat Import latest Samsung release 2017-04-18 03:43:52 +02:00
exofs
exportfs This is the 3.10.84 stable release 2015-09-30 13:25:40 +05:30
ext2 it's still short a few helpers, but infrastructure should be OK now... 2018-12-03 11:52:03 +01:00
ext3 posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
ext4 ext4: fix bitmap position validation 2019-07-27 21:49:52 +02:00
f2fs UPSTREAM: f2fs: sanity check segment count 2017-09-08 18:49:20 +00:00
fat fat: fix using uninitialized fields of fat_inode/fsinfo_inode 2019-07-27 21:43:58 +02:00
freevxfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
fscache FS-Cache: fix dereference of NULL user_key_payload 2019-07-27 21:44:20 +02:00
fuse fuse: initialize the flock flag in fuse_file on allocation 2019-07-27 21:44:16 +02:00
gfs2 posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
hfs Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
hfsplus Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
hostfs uml: fix hostfs mknod() 2016-03-03 15:06:23 -08:00
hpfs Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
hppfs
hugetlbfs mm: larger stack guard gap, between vmas 2017-07-11 00:00:39 +00:00
isofs isofs: fix timestamps beyond 2027 2019-07-27 21:46:04 +02:00
jbd
jbd2 This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
jffs2 Merge tag 'LA.BR.1.3.6-03910-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2017-05-26 13:28:48 +02:00
jfs posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
lockd lockd: create NSM handles per net namespace 2016-03-03 15:06:20 -08:00
logfs
minix it's still short a few helpers, but infrastructure should be OK now... 2018-12-03 11:52:03 +01:00
ncpfs This is the 3.10.84 stable release 2015-09-30 13:25:40 +05:30
nfs This is the 3.10.99 stable release 2017-04-18 17:17:46 +02:00
nfs_common
nfsd nfsd: auth: Fix gid sorting when rootsquash enabled 2019-07-27 21:46:18 +02:00
nilfs2 This is the 3.10.84 stable release 2015-09-30 13:25:40 +05:30
nls
notify vfs: Add permission2 for filesystems with per mount permissions 2018-02-06 13:12:19 +01:00
ntfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
ocfs2 posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
omfs fs, omfs: add NULL terminator in the end up the token list 2015-06-05 23:19:54 -07:00
openpromfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
proc UPSTREAM: capabilities: ambient capabilities 2018-02-06 13:12:16 +01:00
pstore pstore/ram: Use memcpy_fromio() to save old buffer 2019-07-27 21:42:50 +02:00
qnx4 fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
qnx6 fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
quota quota: provide interface for readding allocated space into reserved space 2015-01-29 17:40:57 -08:00
ramfs
reiserfs posix_acl: Clear SGID bit when setting file permissions 2017-04-28 00:00:11 -07:00
romfs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
sdcardfs ANDROID: sdcardfs: Protect set_top 2018-08-15 14:40:15 +02:00
sdfat Import T813XXS2BRC2 kernel source changes 2018-05-26 00:39:42 +02:00
squashfs Squashfs: Add LZ4 compression configuration option 2015-09-16 18:20:12 +05:30
sysfs Import latest Samsung release 2017-04-18 03:43:52 +02:00
sysv This is the 3.10.97 stable release 2017-04-18 17:17:20 +02:00
ubifs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
udf This is the 3.10.98 stable release 2017-04-18 17:17:24 +02:00
ufs fs: push sync_filesystem() down to the file system's remount_fs() 2015-09-16 18:20:11 +05:30
xfs posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
yaffs2
Kconfig Initial port of sdcardfs 2018-02-06 13:12:17 +01:00
Kconfig.binfmt
Makefile Initial port of sdcardfs 2018-02-06 13:12:17 +01:00
aio.c fix io_destroy()/aio_complete() race 2019-07-27 21:49:38 +02:00
anon_inodes.c
attr.c vfs: Add setattr2 for filesystems with per mount permissions 2018-02-06 13:12:20 +01:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c This is the 3.10.97 stable release 2017-04-18 17:17:20 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
bio-integrity.c
bio.c more bio_map_user_iov() leak fixes 2019-07-27 21:45:37 +02:00
block_dev.c block: protect iterate_bdevs() against concurrent close 2019-07-27 21:42:54 +02:00
buffer.c Import latest Samsung release 2017-04-18 03:43:52 +02:00
char_dev.c
compat.c constify ->actor 2015-09-16 18:20:09 +05:30
compat_binfmt_elf.c binfmt_elf: add ELF_HWCAP2 to compat auxv entries 2015-03-19 14:52:32 -07:00
compat_ioctl.c
coredump.c coredump: fix unfreezable coredumping task 2019-07-27 21:42:15 +02:00
coredump.h
dcache.c fs: take_dentry_name_snapshot: avoid kfree under spinlock fixup 2019-07-27 21:45:27 +02:00
dcookies.c
direct-io.c direct-io: Prevent NULL pointer access in submit_page_section 2019-07-27 21:44:19 +02:00
drop_caches.c Import latest Samsung release 2017-04-18 03:43:52 +02:00
eventfd.c
eventpoll.c epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() 2019-07-27 21:45:14 +02:00
exec.c fs: exec: apply CLOEXEC before changing dumpable task flags 2019-07-27 21:43:25 +02:00
fcntl.c vfs: add missing check for __O_TMPFILE in fcntl_init() 2018-12-03 11:52:41 +01:00
fhandle.c vfs: read file_handle only once in handle_to_path. 2015-07-22 07:25:30 -07:00
file.c
file_table.c get rid of s_files and files_lock 2015-07-03 19:48:08 -07:00
filesystems.c
fs-writeback.c sync: don't block the flusher thread waiting on IO 2015-09-16 18:20:20 +05:30
fs_struct.c sdcardfs: override umask on mkdir and create 2018-02-06 13:12:18 +01:00
generic_acl.c tmpfs: clear S_ISGID when setting posix ACLs 2017-04-22 23:02:57 +02:00
inode.c allow the temp files created by open() to be linked to 2018-12-03 11:52:08 +01:00
internal.h vfs: Allow filesystems to access their private mount data 2018-02-06 13:12:19 +01:00
ioctl.c
ioprio.c block: fix use-after-free in sys_ioprio_get() 2016-11-19 20:01:20 -08:00
libfs.c move d_rcu from overlapping d_child to overlapping d_alias 2015-04-29 10:34:00 +02:00
locks.c locks: fix unlock when fcntl_setlk races with a close 2016-03-09 15:31:53 -08:00
mbcache.c
mount.h
mpage.c
namei.c VFS: Properly free dentry name snapshots in vfs_rename2 2019-07-27 21:46:08 +02:00
namespace.c vfs: Allow filesystems to access their private mount data 2018-02-06 13:12:19 +01:00
no-block.c
open.c fs: Fix file mode for O_TMPFILE 2018-12-03 11:52:40 +01:00
pipe.c pipe: read buffer limits atomically 2019-07-27 21:49:46 +02:00
pnode.c ANDROID: mnt: remount should propagate to slaves of slaves 2018-02-06 13:12:20 +01:00
pnode.h ANDROID: mnt: remount should propagate to slaves of slaves 2018-02-06 13:12:20 +01:00
posix_acl.c posix_acl: Clear SGID bit when setting file permissions 2019-07-27 21:42:52 +02:00
proc_namespace.c vfs: Allow filesystems to access their private mount data 2018-02-06 13:12:19 +01:00
read_write.c fs: Workaround the compiler's bad optimization 2016-02-04 13:23:34 +05:30
readdir.c fs: readdir: Fix su hide patch for non-iterate filesystems 2017-07-14 21:04:43 +02:00
select.c
seq_file.c fs/seq_file: fix out-of-bounds read 2019-07-27 21:42:21 +02:00
signalfd.c signalfd: fix information leak in signalfd_copyinfo 2015-08-16 20:51:42 -07:00
splice.c vfs: fix uninitialized flags in splice_to_pipe() 2019-07-27 21:43:53 +02:00
stack.c
stat.c quota: provide interface for readding allocated space into reserved space 2015-01-29 17:40:57 -08:00
statfs.c
super.c vfs: Allow filesystems to access their private mount data 2018-02-06 13:12:19 +01:00
sync.c Import T813XXS2BRC2 kernel source changes 2018-05-26 00:39:42 +02:00
timerfd.c timerfd: Protect the might cancel mechanism proper 2017-11-08 05:33:07 -08:00
utimes.c vfs: Add setattr2 for filesystems with per mount permissions 2018-02-06 13:12:20 +01:00
xattr.c ANDROID: xattr: Pass EOPNOTSUPP to permission2 2018-08-15 14:40:12 +02:00
xattr_acl.c