diff options
| author | HyungJung Joo <jhj140711@gmail.com> | 2026-03-17 08:48:27 +0300 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-03-17 17:35:54 +0300 |
| commit | 0621c385fda1376e967f37ccd534c26c3e511d14 (patch) | |
| tree | fbc64d3c3945642b72ac40c2ec596a48604712c7 | |
| parent | 2727d44f5d5bc3f8e55a6a0ccf24d8105a5a400e (diff) | |
| download | linux-0621c385fda1376e967f37ccd534c26c3e511d14.tar.xz | |
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE),
but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).
Later, omfs_make_empty() uses
sbi->s_sys_blocksize - OMFS_DIR_START
as the length argument to memset(). Since s_sys_blocksize is u32,
a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes
an unsigned underflow there, wrapping to a value near 2^32. That drives
a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel
memory far beyond the backing block buffer.
Add the corresponding lower-bound check alongside the existing upper-bound
check in omfs_fill_super(), so that malformed images are rejected during
superblock validation before any filesystem data is processed.
Fixes: a3ab7155ea21 ("omfs: add directory routines")
Signed-off-by: Hyungjung Joo <jhj140711@gmail.com>
Link: https://patch.msgid.link/20260317054827.1822061-1-jhj140711@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | fs/omfs/inode.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 701ed85d9831..23aa3f54aaba 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -513,6 +513,12 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc) goto out_brelse_bh; } + if (sbi->s_sys_blocksize < OMFS_DIR_START) { + printk(KERN_ERR "omfs: sysblock size (%d) is too small\n", + sbi->s_sys_blocksize); + goto out_brelse_bh; + } + if (sbi->s_blocksize < sbi->s_sys_blocksize || sbi->s_blocksize > OMFS_MAX_BLOCK_SIZE) { printk(KERN_ERR "omfs: block size (%d) is out of range\n", |