Files
linux-stable-mirror/fs/minix/minix.h
T
Michael BommaritoandChristian Brauner fb3e566caf minix: avoid overflow in bitmap block count calculation
minix_check_superblock() uses minix_blocks_needed() to verify that the
on-disk imap and zmap block counts are large enough for the advertised
inode and zone counts.

The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.
A Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the
addition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap
block count look valid, after which minix_fill_super() can dereference
s_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.

Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is
near UINT_MAX makes minix_check_superblock() accept a zero bitmap-block
count and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking
the kernel.

The divisor is the bitmap capacity in bits, blocksize * 8, which is
always a power of two: minix_fill_super() obtains the block size through
sb_set_blocksize(), and blk_validate_block_size() rejects any size that
is not a power of two. Use DIV_ROUND_UP_POW2(), which divides before
adding the round-up term and so cannot overflow for a power-of-two
divisor.

Fixes: 8c97a6ddc9 ("minix: Add required sanity checking to minix_check_superblock()")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618143922.3066874-1-michael.bommarito@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-01 15:26:24 +02:00

182 lines
5.5 KiB
C

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef FS_MINIX_H
#define FS_MINIX_H
#include <linux/fs.h>
#include <linux/pagemap.h>
#include <linux/minix_fs.h>
#define INODE_VERSION(inode) minix_sb(inode->i_sb)->s_version
#define MINIX_V1 0x0001 /* original minix fs */
#define MINIX_V2 0x0002 /* minix V2 fs */
#define MINIX_V3 0x0003 /* minix V3 fs */
/*
* minix fs inode data in memory
*/
struct minix_inode_info {
union {
__u16 i1_data[16];
__u32 i2_data[16];
} u;
struct mapping_metadata_bhs i_metadata_bhs;
struct inode vfs_inode;
};
/*
* minix super-block data in memory
*/
struct minix_sb_info {
unsigned long s_ninodes;
unsigned long s_nzones;
unsigned long s_imap_blocks;
unsigned long s_zmap_blocks;
unsigned long s_firstdatazone;
unsigned long s_log_zone_size;
int s_dirsize;
int s_namelen;
struct buffer_head ** s_imap;
struct buffer_head ** s_zmap;
struct buffer_head * s_sbh;
struct minix_super_block * s_ms;
unsigned short s_mount_state;
unsigned short s_version;
};
void __minix_error_inode(struct inode *inode, const char *function,
unsigned int line, const char *fmt, ...);
struct inode *minix_iget(struct super_block *, unsigned long);
struct minix_inode *minix_V1_raw_inode(struct super_block *, ino_t, struct buffer_head **);
struct minix2_inode *minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
struct inode *minix_new_inode(const struct inode *, umode_t);
void minix_free_inode(struct inode *inode);
unsigned long minix_count_free_inodes(struct super_block *sb);
int minix_new_block(struct inode *inode);
void minix_free_block(struct inode *inode, unsigned long block);
unsigned long minix_count_free_blocks(struct super_block *sb);
int minix_getattr(struct mnt_idmap *, const struct path *,
struct kstat *, u32, unsigned int);
int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len);
struct mapping_metadata_bhs *minix_get_metadata_bhs(struct inode *inode);
int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync);
extern void V1_minix_truncate(struct inode *);
extern void V2_minix_truncate(struct inode *);
extern void minix_truncate(struct inode *);
extern void minix_set_inode(struct inode *, dev_t);
extern int V1_minix_get_block(struct inode *, long, struct buffer_head *, int);
extern int V2_minix_get_block(struct inode *, long, struct buffer_head *, int);
extern unsigned V1_minix_blocks(loff_t, struct super_block *);
extern unsigned V2_minix_blocks(loff_t, struct super_block *);
struct minix_dir_entry *minix_find_entry(struct dentry *, struct folio **);
int minix_add_link(struct dentry*, struct inode*);
int minix_delete_entry(struct minix_dir_entry *, struct folio *);
int minix_make_empty(struct inode*, struct inode*);
int minix_empty_dir(struct inode*);
int minix_set_link(struct minix_dir_entry *de, struct folio *folio,
struct inode *inode);
struct minix_dir_entry *minix_dotdot(struct inode*, struct folio **);
ino_t minix_inode_by_name(struct dentry*);
extern const struct inode_operations minix_file_inode_operations;
extern const struct inode_operations minix_dir_inode_operations;
extern const struct file_operations minix_file_operations;
extern const struct file_operations minix_dir_operations;
static inline struct minix_sb_info *minix_sb(struct super_block *sb)
{
return sb->s_fs_info;
}
static inline struct minix_inode_info *minix_i(struct inode *inode)
{
return container_of(inode, struct minix_inode_info, vfs_inode);
}
static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
{
return DIV_ROUND_UP_POW2(bits, blocksize * 8);
}
#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
#error Minix file system byte order broken
#elif defined(CONFIG_MINIX_FS_NATIVE_ENDIAN)
/*
* big-endian 32 or 64 bit indexed bitmaps on big-endian system or
* little-endian bitmaps on little-endian system
*/
#define minix_test_and_set_bit(nr, addr) \
__test_and_set_bit((nr), (unsigned long *)(addr))
#define minix_set_bit(nr, addr) \
__set_bit((nr), (unsigned long *)(addr))
#define minix_test_and_clear_bit(nr, addr) \
__test_and_clear_bit((nr), (unsigned long *)(addr))
#define minix_test_bit(nr, addr) \
test_bit((nr), (unsigned long *)(addr))
#define minix_find_first_zero_bit(addr, size) \
find_first_zero_bit((unsigned long *)(addr), (size))
#elif defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
/*
* big-endian 16bit indexed bitmaps
*/
static inline int minix_find_first_zero_bit(const void *vaddr, unsigned size)
{
const unsigned short *p = vaddr, *addr = vaddr;
unsigned short num;
if (!size)
return 0;
size >>= 4;
while (*p++ == 0xffff) {
if (--size == 0)
return (p - addr) << 4;
}
num = *--p;
return ((p - addr) << 4) + ffz(num);
}
#define minix_test_and_set_bit(nr, addr) \
__test_and_set_bit((nr) ^ 16, (unsigned long *)(addr))
#define minix_set_bit(nr, addr) \
__set_bit((nr) ^ 16, (unsigned long *)(addr))
#define minix_test_and_clear_bit(nr, addr) \
__test_and_clear_bit((nr) ^ 16, (unsigned long *)(addr))
static inline int minix_test_bit(int nr, const void *vaddr)
{
const unsigned short *p = vaddr;
return (p[nr >> 4] & (1U << (nr & 15))) != 0;
}
#else
/*
* little-endian bitmaps
*/
#define minix_test_and_set_bit __test_and_set_bit_le
#define minix_set_bit __set_bit_le
#define minix_test_and_clear_bit __test_and_clear_bit_le
#define minix_test_bit test_bit_le
#define minix_find_first_zero_bit find_first_zero_bit_le
#endif
#define minix_error_inode(inode, fmt, ...) \
__minix_error_inode((inode), __func__, __LINE__, \
(fmt), ##__VA_ARGS__)
#endif /* FS_MINIX_H */