ext2: Add more validity checks for inode counts

[ Upstream commit e984e62e81bd99a2e8719e4a5aa6802de92ce18b ]

Add checks verifying number of inodes stored in the superblock matches
the number computed from number of inodes per group. Also verify we have
at least one block worth of inodes per group. This prevents crashes on
corrupted filesystems.

Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index db403c01d4d5c0647876a24ddcee0048bcd8234b..644c83c115bc219080c6bdc992ee2321becf6707 100644 (file)
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1077,9 +1077,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
                        sbi->s_frags_per_group);
                goto failed_mount;
        }
-       if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {
+       if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
+           sbi->s_inodes_per_group > sb->s_blocksize * 8) {
                ext2_msg(sb, KERN_ERR,
-                       "error: #inodes per group too big: %lu",
+                       "error: invalid #inodes per group: %lu",
                        sbi->s_inodes_per_group);
                goto failed_mount;
        }
@@ -1089,6 +1090,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
        sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
                                le32_to_cpu(es->s_first_data_block) - 1)
                                        / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
+       if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=
+           le32_to_cpu(es->s_inodes_count)) {
+               ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",
+                        le32_to_cpu(es->s_inodes_count),
+                        (u64)sbi->s_groups_count * sbi->s_inodes_per_group);
+               goto failed_mount;
+       }
        db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
                   EXT2_DESC_PER_BLOCK(sb);
        sbi->s_group_desc = kmalloc_array (db_count,