| Message ID | 23729d08-aeba-7375-ca65-7658faa908e8@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | isofs: reject hardware sector size > 2048 bytes | expand |
On Thu 16-08-18 21:44:02, Eric Sandeen wrote: > The largest block size supported by isofs is ISOFS_BLOCK_SIZE (2048), but > isofs_fill_super calls sb_min_blocksize and sets the blocksize to the > device's logical block size if it's larger than what we ended up with after > option parsing. > > If for some reason we try to mount a hard 4k device as an isofs filesystem, > we'll set opt.blocksize to 4096, and when we try to read the superblock > we found via: > > block = iso_blknum << (ISOFS_BLOCK_BITS - s->s_blocksize_bits) > > with s_blocksize_bits greater than ISOFS_BLOCK_BITS, we'll have a negative > shift and the bread will fail somewhat cryptically: > > isofs_fill_super: bread failed, dev=sda, iso_blknum=17, block=-2147483648 > > It seems best to just catch and clearly reject mounts of such a device. > > Reported-by: Bryan Gurney <bgurney@redhat.com> > Signed-off-by: Eric Sandeen <sandeen@redhat.com> Thanks Eric, I'll take this patch through my tree for rc2. Honza > --- > > diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c > index ec3fba7d492f..488a9e7f8f66 100644 > --- a/fs/isofs/inode.c > +++ b/fs/isofs/inode.c > @@ -24,6 +24,7 @@ > #include <linux/mpage.h> > #include <linux/user_namespace.h> > #include <linux/seq_file.h> > +#include <linux/blkdev.h> > > #include "isofs.h" > #include "zisofs.h" > @@ -653,6 +654,12 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent) > /* > * What if bugger tells us to go beyond page size? > */ > + if (bdev_logical_block_size(s->s_bdev) > 2048) { > + printk(KERN_WARNING > + "ISOFS: unsupported/invalid hardware sector size %d\n", > + bdev_logical_block_size(s->s_bdev)); > + goto out_freesbi; > + } > opt.blocksize = sb_min_blocksize(s, opt.blocksize); > > sbi->s_high_sierra = 0; /* default is iso9660 */ >
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c index ec3fba7d492f..488a9e7f8f66 100644 --- a/fs/isofs/inode.c +++ b/fs/isofs/inode.c @@ -24,6 +24,7 @@ #include <linux/mpage.h> #include <linux/user_namespace.h> #include <linux/seq_file.h> +#include <linux/blkdev.h> #include "isofs.h" #include "zisofs.h" @@ -653,6 +654,12 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent) /* * What if bugger tells us to go beyond page size? */ + if (bdev_logical_block_size(s->s_bdev) > 2048) { + printk(KERN_WARNING + "ISOFS: unsupported/invalid hardware sector size %d\n", + bdev_logical_block_size(s->s_bdev)); + goto out_freesbi; + } opt.blocksize = sb_min_blocksize(s, opt.blocksize); sbi->s_high_sierra = 0; /* default is iso9660 */
The largest block size supported by isofs is ISOFS_BLOCK_SIZE (2048), but isofs_fill_super calls sb_min_blocksize and sets the blocksize to the device's logical block size if it's larger than what we ended up with after option parsing. If for some reason we try to mount a hard 4k device as an isofs filesystem, we'll set opt.blocksize to 4096, and when we try to read the superblock we found via: block = iso_blknum << (ISOFS_BLOCK_BITS - s->s_blocksize_bits) with s_blocksize_bits greater than ISOFS_BLOCK_BITS, we'll have a negative shift and the bread will fail somewhat cryptically: isofs_fill_super: bread failed, dev=sda, iso_blknum=17, block=-2147483648 It seems best to just catch and clearly reject mounts of such a device. Reported-by: Bryan Gurney <bgurney@redhat.com> Signed-off-by: Eric Sandeen <sandeen@redhat.com> ---