ext2: Add more validity checks for inode counts

Add checks verifying number of inodes stored in the superblock matches
the number computed from number of inodes per group. Also verify we have
at least one block worth of inodes per group. This prevents crashes on
corrupted filesystems.

Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 300f2f0cf566d83d47466410e57a4b9690f9d5b1..6f475d2e3b183c30b1e00c7403e8405a3a122e7e 100644 (file)
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1059,9 +1059,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
                        sbi->s_frags_per_group);
                goto failed_mount;
        }
-       if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {
+       if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
+           sbi->s_inodes_per_group > sb->s_blocksize * 8) {
                ext2_msg(sb, KERN_ERR,
-                       "error: #inodes per group too big: %lu",
+                       "error: invalid #inodes per group: %lu",
                        sbi->s_inodes_per_group);
                goto failed_mount;
        }
@@ -1071,6 +1072,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
        sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
                                le32_to_cpu(es->s_first_data_block) - 1)
                                        / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
+       if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=
+           le32_to_cpu(es->s_inodes_count)) {
+               ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",
+                        le32_to_cpu(es->s_inodes_count),
+                        (u64)sbi->s_groups_count * sbi->s_inodes_per_group);
+               goto failed_mount;
+       }
        db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
                   EXT2_DESC_PER_BLOCK(sb);
        sbi->s_group_desc = kmalloc_array(db_count,