mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
minix_check_superblock() uses minix_blocks_needed() to verify that the
on-disk imap and zmap block counts are large enough for the advertised
inode and zone counts.
The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.
A Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the
addition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap
block count look valid, after which minix_fill_super() can dereference
s_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.
Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is
near UINT_MAX makes minix_check_superblock() accept a zero bitmap-block
count and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking
the kernel.
The divisor is the bitmap capacity in bits, blocksize * 8, which is
always a power of two: minix_fill_super() obtains the block size through
sb_set_blocksize(), and blk_validate_block_size() rejects any size that
is not a power of two. Use DIV_ROUND_UP_POW2(), which divides before
adding the round-up term and so cannot overflow for a power-of-two
divisor.
Fixes: 8c97a6ddc9 ("minix: Add required sanity checking to minix_check_superblock()")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618143922.3066874-1-michael.bommarito@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
182 lines
5.5 KiB
C
182 lines
5.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef FS_MINIX_H
|
|
#define FS_MINIX_H
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/minix_fs.h>
|
|
|
|
#define INODE_VERSION(inode) minix_sb(inode->i_sb)->s_version
|
|
#define MINIX_V1 0x0001 /* original minix fs */
|
|
#define MINIX_V2 0x0002 /* minix V2 fs */
|
|
#define MINIX_V3 0x0003 /* minix V3 fs */
|
|
|
|
/*
|
|
* minix fs inode data in memory
|
|
*/
|
|
struct minix_inode_info {
|
|
union {
|
|
__u16 i1_data[16];
|
|
__u32 i2_data[16];
|
|
} u;
|
|
struct mapping_metadata_bhs i_metadata_bhs;
|
|
struct inode vfs_inode;
|
|
};
|
|
|
|
/*
|
|
* minix super-block data in memory
|
|
*/
|
|
struct minix_sb_info {
|
|
unsigned long s_ninodes;
|
|
unsigned long s_nzones;
|
|
unsigned long s_imap_blocks;
|
|
unsigned long s_zmap_blocks;
|
|
unsigned long s_firstdatazone;
|
|
unsigned long s_log_zone_size;
|
|
int s_dirsize;
|
|
int s_namelen;
|
|
struct buffer_head ** s_imap;
|
|
struct buffer_head ** s_zmap;
|
|
struct buffer_head * s_sbh;
|
|
struct minix_super_block * s_ms;
|
|
unsigned short s_mount_state;
|
|
unsigned short s_version;
|
|
};
|
|
|
|
void __minix_error_inode(struct inode *inode, const char *function,
|
|
unsigned int line, const char *fmt, ...);
|
|
|
|
struct inode *minix_iget(struct super_block *, unsigned long);
|
|
struct minix_inode *minix_V1_raw_inode(struct super_block *, ino_t, struct buffer_head **);
|
|
struct minix2_inode *minix_V2_raw_inode(struct super_block *, ino_t, struct buffer_head **);
|
|
struct inode *minix_new_inode(const struct inode *, umode_t);
|
|
void minix_free_inode(struct inode *inode);
|
|
unsigned long minix_count_free_inodes(struct super_block *sb);
|
|
int minix_new_block(struct inode *inode);
|
|
void minix_free_block(struct inode *inode, unsigned long block);
|
|
unsigned long minix_count_free_blocks(struct super_block *sb);
|
|
int minix_getattr(struct mnt_idmap *, const struct path *,
|
|
struct kstat *, u32, unsigned int);
|
|
int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len);
|
|
struct mapping_metadata_bhs *minix_get_metadata_bhs(struct inode *inode);
|
|
int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync);
|
|
|
|
extern void V1_minix_truncate(struct inode *);
|
|
extern void V2_minix_truncate(struct inode *);
|
|
extern void minix_truncate(struct inode *);
|
|
extern void minix_set_inode(struct inode *, dev_t);
|
|
extern int V1_minix_get_block(struct inode *, long, struct buffer_head *, int);
|
|
extern int V2_minix_get_block(struct inode *, long, struct buffer_head *, int);
|
|
extern unsigned V1_minix_blocks(loff_t, struct super_block *);
|
|
extern unsigned V2_minix_blocks(loff_t, struct super_block *);
|
|
|
|
struct minix_dir_entry *minix_find_entry(struct dentry *, struct folio **);
|
|
int minix_add_link(struct dentry*, struct inode*);
|
|
int minix_delete_entry(struct minix_dir_entry *, struct folio *);
|
|
int minix_make_empty(struct inode*, struct inode*);
|
|
int minix_empty_dir(struct inode*);
|
|
int minix_set_link(struct minix_dir_entry *de, struct folio *folio,
|
|
struct inode *inode);
|
|
struct minix_dir_entry *minix_dotdot(struct inode*, struct folio **);
|
|
ino_t minix_inode_by_name(struct dentry*);
|
|
|
|
extern const struct inode_operations minix_file_inode_operations;
|
|
extern const struct inode_operations minix_dir_inode_operations;
|
|
extern const struct file_operations minix_file_operations;
|
|
extern const struct file_operations minix_dir_operations;
|
|
|
|
static inline struct minix_sb_info *minix_sb(struct super_block *sb)
|
|
{
|
|
return sb->s_fs_info;
|
|
}
|
|
|
|
static inline struct minix_inode_info *minix_i(struct inode *inode)
|
|
{
|
|
return container_of(inode, struct minix_inode_info, vfs_inode);
|
|
}
|
|
|
|
static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
|
|
{
|
|
return DIV_ROUND_UP_POW2(bits, blocksize * 8);
|
|
}
|
|
|
|
#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
|
|
defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
|
|
|
|
#error Minix file system byte order broken
|
|
|
|
#elif defined(CONFIG_MINIX_FS_NATIVE_ENDIAN)
|
|
|
|
/*
|
|
* big-endian 32 or 64 bit indexed bitmaps on big-endian system or
|
|
* little-endian bitmaps on little-endian system
|
|
*/
|
|
|
|
#define minix_test_and_set_bit(nr, addr) \
|
|
__test_and_set_bit((nr), (unsigned long *)(addr))
|
|
#define minix_set_bit(nr, addr) \
|
|
__set_bit((nr), (unsigned long *)(addr))
|
|
#define minix_test_and_clear_bit(nr, addr) \
|
|
__test_and_clear_bit((nr), (unsigned long *)(addr))
|
|
#define minix_test_bit(nr, addr) \
|
|
test_bit((nr), (unsigned long *)(addr))
|
|
#define minix_find_first_zero_bit(addr, size) \
|
|
find_first_zero_bit((unsigned long *)(addr), (size))
|
|
|
|
#elif defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
|
|
|
|
/*
|
|
* big-endian 16bit indexed bitmaps
|
|
*/
|
|
|
|
static inline int minix_find_first_zero_bit(const void *vaddr, unsigned size)
|
|
{
|
|
const unsigned short *p = vaddr, *addr = vaddr;
|
|
unsigned short num;
|
|
|
|
if (!size)
|
|
return 0;
|
|
|
|
size >>= 4;
|
|
while (*p++ == 0xffff) {
|
|
if (--size == 0)
|
|
return (p - addr) << 4;
|
|
}
|
|
|
|
num = *--p;
|
|
return ((p - addr) << 4) + ffz(num);
|
|
}
|
|
|
|
#define minix_test_and_set_bit(nr, addr) \
|
|
__test_and_set_bit((nr) ^ 16, (unsigned long *)(addr))
|
|
#define minix_set_bit(nr, addr) \
|
|
__set_bit((nr) ^ 16, (unsigned long *)(addr))
|
|
#define minix_test_and_clear_bit(nr, addr) \
|
|
__test_and_clear_bit((nr) ^ 16, (unsigned long *)(addr))
|
|
|
|
static inline int minix_test_bit(int nr, const void *vaddr)
|
|
{
|
|
const unsigned short *p = vaddr;
|
|
return (p[nr >> 4] & (1U << (nr & 15))) != 0;
|
|
}
|
|
|
|
#else
|
|
|
|
/*
|
|
* little-endian bitmaps
|
|
*/
|
|
|
|
#define minix_test_and_set_bit __test_and_set_bit_le
|
|
#define minix_set_bit __set_bit_le
|
|
#define minix_test_and_clear_bit __test_and_clear_bit_le
|
|
#define minix_test_bit test_bit_le
|
|
#define minix_find_first_zero_bit find_first_zero_bit_le
|
|
|
|
#endif
|
|
|
|
#define minix_error_inode(inode, fmt, ...) \
|
|
__minix_error_inode((inode), __func__, __LINE__, \
|
|
(fmt), ##__VA_ARGS__)
|
|
|
|
#endif /* FS_MINIX_H */
|