[14/31] libext2fs: Fix ext2fs_open2() truncation of the superblock parameter

Since it's possible for very large filesystems to store backup superblocks at
very large (> 2^32) block numbers, we need to be able to handle the case of a
caller directing us to read one of these high-numbered backups.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 debugfs/debugfs.c   |    4 ++--
 e2fsck/journal.c    |    6 +++---
 e2fsck/unix.c       |    8 ++++----
 lib/ext2fs/ext2fs.h |    4 ++++
 lib/ext2fs/openfs.c |   13 +++++++++++--
 misc/dumpe2fs.c     |    4 ++--
 6 files changed, 26 insertions(+), 13 deletions(-)



--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Mon, 30 Sep 2013, Darrick J. Wong wrote:

> Date: Mon, 30 Sep 2013 18:28:12 -0700
> From: Darrick J. Wong <darrick.wong@oracle.com>
> To: tytso@mit.edu, darrick.wong@oracle.com
> Cc: linux-ext4@vger.kernel.org
> Subject: [PATCH 14/31] libext2fs: Fix ext2fs_open2() truncation of the
>     superblock parameter
> 
> Since it's possible for very large filesystems to store backup superblocks at
> very large (> 2^32) block numbers, we need to be able to handle the case of a
> caller directing us to read one of these high-numbered backups.

I do not think this is enough, because in ext2fs_open2() or rather
ext2fs_open3() as you rename it we read the superblock block with
io_channel_read_blk() which takes unsigned long as a block number
rather than io_channel_read_blk64().

Having a simple test for this particular case might be useful.

Thanks!
-Lukas



> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  debugfs/debugfs.c   |    4 ++--
>  e2fsck/journal.c    |    6 +++---
>  e2fsck/unix.c       |    8 ++++----
>  lib/ext2fs/ext2fs.h |    4 ++++
>  lib/ext2fs/openfs.c |   13 +++++++++++--
>  misc/dumpe2fs.c     |    4 ++--
>  6 files changed, 26 insertions(+), 13 deletions(-)
> 
> 
> diff --git a/debugfs/debugfs.c b/debugfs/debugfs.c
> index 2660218..da44ce4 100644
> --- a/debugfs/debugfs.c
> +++ b/debugfs/debugfs.c
> @@ -80,8 +80,8 @@ static void open_filesystem(char *device, int open_flags, blk64_t superblock,
>  	if (catastrophic)
>  		open_flags |= EXT2_FLAG_SKIP_MMP;
>  
> -	retval = ext2fs_open(device, open_flags, superblock, blocksize,
> -			     unix_io_manager, &current_fs);
> +	retval = ext2fs_open3(device, NULL, open_flags, superblock, blocksize,
> +			      unix_io_manager, &current_fs);
>  	if (retval) {
>  		com_err(device, retval, "while opening filesystem");
>  		current_fs = NULL;
> diff --git a/e2fsck/journal.c b/e2fsck/journal.c
> index 2509303..af35a38 100644
> --- a/e2fsck/journal.c
> +++ b/e2fsck/journal.c
> @@ -967,9 +967,9 @@ int e2fsck_run_ext3_journal(e2fsck_t ctx)
>  
>  	ext2fs_mmp_stop(ctx->fs);
>  	ext2fs_free(ctx->fs);
> -	retval = ext2fs_open(ctx->filesystem_name, EXT2_FLAG_RW,
> -			     ctx->superblock, blocksize, io_ptr,
> -			     &ctx->fs);
> +	retval = ext2fs_open3(ctx->filesystem_name, NULL, EXT2_FLAG_RW,
> +			      ctx->superblock, blocksize, io_ptr,
> +			      &ctx->fs);
>  	if (retval) {
>  		com_err(ctx->program_name, retval,
>  			_("while trying to re-open %s"),
> diff --git a/e2fsck/unix.c b/e2fsck/unix.c
> index 0546653..fb41ca0 100644
> --- a/e2fsck/unix.c
> +++ b/e2fsck/unix.c
> @@ -1040,7 +1040,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
>  
>  	*ret_fs = NULL;
>  	if (ctx->superblock && ctx->blocksize) {
> -		retval = ext2fs_open2(ctx->filesystem_name, ctx->io_options,
> +		retval = ext2fs_open3(ctx->filesystem_name, ctx->io_options,
>  				      flags, ctx->superblock, ctx->blocksize,
>  				      io_ptr, ret_fs);
>  	} else if (ctx->superblock) {
> @@ -1051,7 +1051,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
>  				ext2fs_free(*ret_fs);
>  				*ret_fs = NULL;
>  			}
> -			retval = ext2fs_open2(ctx->filesystem_name,
> +			retval = ext2fs_open3(ctx->filesystem_name,
>  					      ctx->io_options, flags,
>  					      ctx->superblock, blocksize,
>  					      io_ptr, ret_fs);
> @@ -1059,7 +1059,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
>  				break;
>  		}
>  	} else
> -		retval = ext2fs_open2(ctx->filesystem_name, ctx->io_options,
> +		retval = ext2fs_open3(ctx->filesystem_name, ctx->io_options,
>  				      flags, 0, 0, io_ptr, ret_fs);
>  
>  	if (retval == 0)
> @@ -1375,7 +1375,7 @@ failure:
>  	 * don't need to update the mount count and last checked
>  	 * fields in the backup superblock (the kernel doesn't update
>  	 * the backup superblocks anyway).  With newer versions of the
> -	 * library this flag is set by ext2fs_open2(), but we set this
> +	 * library this flag is set by ext2fs_open3(), but we set this
>  	 * here just to be sure.  (No, we don't support e2fsck running
>  	 * with some other libext2fs than the one that it was shipped
>  	 * with, but just in case....)
> diff --git a/lib/ext2fs/ext2fs.h b/lib/ext2fs/ext2fs.h
> index c37e00b..d5d8d03 100644
> --- a/lib/ext2fs/ext2fs.h
> +++ b/lib/ext2fs/ext2fs.h
> @@ -1437,6 +1437,10 @@ extern errcode_t ext2fs_open2(const char *name, const char *io_options,
>  			      int flags, int superblock,
>  			      unsigned int block_size, io_manager manager,
>  			      ext2_filsys *ret_fs);
> +extern errcode_t ext2fs_open3(const char *name, const char *io_options,
> +			      int flags, blk64_t superblock,
> +			      unsigned int block_size, io_manager manager,
> +			      ext2_filsys *ret_fs);
>  extern blk64_t ext2fs_descriptor_block_loc2(ext2_filsys fs,
>  					blk64_t group_block, dgrp_t i);
>  extern blk_t ext2fs_descriptor_block_loc(ext2_filsys fs, blk_t group_block,
> diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
> index 89117f4..3c0bf14 100644
> --- a/lib/ext2fs/openfs.c
> +++ b/lib/ext2fs/openfs.c
> @@ -76,6 +76,15 @@ errcode_t ext2fs_open(const char *name, int flags, int superblock,
>  			    manager, ret_fs);
>  }
>  
> +errcode_t ext2fs_open2(const char *name, const char *io_options,
> +		       int flags, int superblock,
> +		       unsigned int block_size, io_manager manager,
> +		       ext2_filsys *ret_fs)
> +{
> +	return ext2fs_open3(name, io_options, flags, superblock, block_size,
> +			    manager, ret_fs);
> +}
> +
>  /*
>   *  Note: if superblock is non-zero, block-size must also be non-zero.
>   * 	Superblock and block_size can be zero to use the default size.
> @@ -90,8 +99,8 @@ errcode_t ext2fs_open(const char *name, int flags, int superblock,
>   *	EXT2_FLAG_64BITS - Allow 64-bit bitfields (needed for large
>   *				filesystems)
>   */
> -errcode_t ext2fs_open2(const char *name, const char *io_options,
> -		       int flags, int superblock,
> +errcode_t ext2fs_open3(const char *name, const char *io_options,
> +		       int flags, blk64_t superblock,
>  		       unsigned int block_size, io_manager manager,
>  		       ext2_filsys *ret_fs)
>  {
> diff --git a/misc/dumpe2fs.c b/misc/dumpe2fs.c
> index ae70f70..b139977 100644
> --- a/misc/dumpe2fs.c
> +++ b/misc/dumpe2fs.c
> @@ -611,7 +611,7 @@ int main (int argc, char ** argv)
>  		for (use_blocksize = EXT2_MIN_BLOCK_SIZE;
>  		     use_blocksize <= EXT2_MAX_BLOCK_SIZE;
>  		     use_blocksize *= 2) {
> -			retval = ext2fs_open (device_name, flags,
> +			retval = ext2fs_open3(device_name, NULL, flags,
>  					      use_superblock,
>  					      use_blocksize, unix_io_manager,
>  					      &fs);
> @@ -619,7 +619,7 @@ int main (int argc, char ** argv)
>  				break;
>  		}
>  	} else
> -		retval = ext2fs_open (device_name, flags, use_superblock,
> +		retval = ext2fs_open3(device_name, NULL, flags, use_superblock,
>  				      use_blocksize, unix_io_manager, &fs);
>  	if (retval) {
>  		com_err (program_name, retval, _("while trying to open %s"),
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Mon, Oct 07, 2013 at 04:30:39PM +0200, Lukáš Czerner wrote:
> On Mon, 30 Sep 2013, Darrick J. Wong wrote:
> 
> > Date: Mon, 30 Sep 2013 18:28:12 -0700
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > To: tytso@mit.edu, darrick.wong@oracle.com
> > Cc: linux-ext4@vger.kernel.org
> > Subject: [PATCH 14/31] libext2fs: Fix ext2fs_open2() truncation of the
> >     superblock parameter
> > 
> > Since it's possible for very large filesystems to store backup superblocks at
> > very large (> 2^32) block numbers, we need to be able to handle the case of a
> > caller directing us to read one of these high-numbered backups.
> 
> I do not think this is enough, because in ext2fs_open2() or rather
> ext2fs_open3() as you rename it we read the superblock block with
> io_channel_read_blk() which takes unsigned long as a block number
> rather than io_channel_read_blk64().
> 
> Having a simple test for this particular case might be useful.

Good catch!  I've updated the patch.

--D
> 
> Thanks!
> -Lukas
> 
> 
> 
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> >  debugfs/debugfs.c   |    4 ++--
> >  e2fsck/journal.c    |    6 +++---
> >  e2fsck/unix.c       |    8 ++++----
> >  lib/ext2fs/ext2fs.h |    4 ++++
> >  lib/ext2fs/openfs.c |   13 +++++++++++--
> >  misc/dumpe2fs.c     |    4 ++--
> >  6 files changed, 26 insertions(+), 13 deletions(-)
> > 
> > 
> > diff --git a/debugfs/debugfs.c b/debugfs/debugfs.c
> > index 2660218..da44ce4 100644
> > --- a/debugfs/debugfs.c
> > +++ b/debugfs/debugfs.c
> > @@ -80,8 +80,8 @@ static void open_filesystem(char *device, int open_flags, blk64_t superblock,
> >  	if (catastrophic)
> >  		open_flags |= EXT2_FLAG_SKIP_MMP;
> >  
> > -	retval = ext2fs_open(device, open_flags, superblock, blocksize,
> > -			     unix_io_manager, &current_fs);
> > +	retval = ext2fs_open3(device, NULL, open_flags, superblock, blocksize,
> > +			      unix_io_manager, &current_fs);
> >  	if (retval) {
> >  		com_err(device, retval, "while opening filesystem");
> >  		current_fs = NULL;
> > diff --git a/e2fsck/journal.c b/e2fsck/journal.c
> > index 2509303..af35a38 100644
> > --- a/e2fsck/journal.c
> > +++ b/e2fsck/journal.c
> > @@ -967,9 +967,9 @@ int e2fsck_run_ext3_journal(e2fsck_t ctx)
> >  
> >  	ext2fs_mmp_stop(ctx->fs);
> >  	ext2fs_free(ctx->fs);
> > -	retval = ext2fs_open(ctx->filesystem_name, EXT2_FLAG_RW,
> > -			     ctx->superblock, blocksize, io_ptr,
> > -			     &ctx->fs);
> > +	retval = ext2fs_open3(ctx->filesystem_name, NULL, EXT2_FLAG_RW,
> > +			      ctx->superblock, blocksize, io_ptr,
> > +			      &ctx->fs);
> >  	if (retval) {
> >  		com_err(ctx->program_name, retval,
> >  			_("while trying to re-open %s"),
> > diff --git a/e2fsck/unix.c b/e2fsck/unix.c
> > index 0546653..fb41ca0 100644
> > --- a/e2fsck/unix.c
> > +++ b/e2fsck/unix.c
> > @@ -1040,7 +1040,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
> >  
> >  	*ret_fs = NULL;
> >  	if (ctx->superblock && ctx->blocksize) {
> > -		retval = ext2fs_open2(ctx->filesystem_name, ctx->io_options,
> > +		retval = ext2fs_open3(ctx->filesystem_name, ctx->io_options,
> >  				      flags, ctx->superblock, ctx->blocksize,
> >  				      io_ptr, ret_fs);
> >  	} else if (ctx->superblock) {
> > @@ -1051,7 +1051,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
> >  				ext2fs_free(*ret_fs);
> >  				*ret_fs = NULL;
> >  			}
> > -			retval = ext2fs_open2(ctx->filesystem_name,
> > +			retval = ext2fs_open3(ctx->filesystem_name,
> >  					      ctx->io_options, flags,
> >  					      ctx->superblock, blocksize,
> >  					      io_ptr, ret_fs);
> > @@ -1059,7 +1059,7 @@ static errcode_t try_open_fs(e2fsck_t ctx, int flags, io_manager io_ptr,
> >  				break;
> >  		}
> >  	} else
> > -		retval = ext2fs_open2(ctx->filesystem_name, ctx->io_options,
> > +		retval = ext2fs_open3(ctx->filesystem_name, ctx->io_options,
> >  				      flags, 0, 0, io_ptr, ret_fs);
> >  
> >  	if (retval == 0)
> > @@ -1375,7 +1375,7 @@ failure:
> >  	 * don't need to update the mount count and last checked
> >  	 * fields in the backup superblock (the kernel doesn't update
> >  	 * the backup superblocks anyway).  With newer versions of the
> > -	 * library this flag is set by ext2fs_open2(), but we set this
> > +	 * library this flag is set by ext2fs_open3(), but we set this
> >  	 * here just to be sure.  (No, we don't support e2fsck running
> >  	 * with some other libext2fs than the one that it was shipped
> >  	 * with, but just in case....)
> > diff --git a/lib/ext2fs/ext2fs.h b/lib/ext2fs/ext2fs.h
> > index c37e00b..d5d8d03 100644
> > --- a/lib/ext2fs/ext2fs.h
> > +++ b/lib/ext2fs/ext2fs.h
> > @@ -1437,6 +1437,10 @@ extern errcode_t ext2fs_open2(const char *name, const char *io_options,
> >  			      int flags, int superblock,
> >  			      unsigned int block_size, io_manager manager,
> >  			      ext2_filsys *ret_fs);
> > +extern errcode_t ext2fs_open3(const char *name, const char *io_options,
> > +			      int flags, blk64_t superblock,
> > +			      unsigned int block_size, io_manager manager,
> > +			      ext2_filsys *ret_fs);
> >  extern blk64_t ext2fs_descriptor_block_loc2(ext2_filsys fs,
> >  					blk64_t group_block, dgrp_t i);
> >  extern blk_t ext2fs_descriptor_block_loc(ext2_filsys fs, blk_t group_block,
> > diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
> > index 89117f4..3c0bf14 100644
> > --- a/lib/ext2fs/openfs.c
> > +++ b/lib/ext2fs/openfs.c
> > @@ -76,6 +76,15 @@ errcode_t ext2fs_open(const char *name, int flags, int superblock,
> >  			    manager, ret_fs);
> >  }
> >  
> > +errcode_t ext2fs_open2(const char *name, const char *io_options,
> > +		       int flags, int superblock,
> > +		       unsigned int block_size, io_manager manager,
> > +		       ext2_filsys *ret_fs)
> > +{
> > +	return ext2fs_open3(name, io_options, flags, superblock, block_size,
> > +			    manager, ret_fs);
> > +}
> > +
> >  /*
> >   *  Note: if superblock is non-zero, block-size must also be non-zero.
> >   * 	Superblock and block_size can be zero to use the default size.
> > @@ -90,8 +99,8 @@ errcode_t ext2fs_open(const char *name, int flags, int superblock,
> >   *	EXT2_FLAG_64BITS - Allow 64-bit bitfields (needed for large
> >   *				filesystems)
> >   */
> > -errcode_t ext2fs_open2(const char *name, const char *io_options,
> > -		       int flags, int superblock,
> > +errcode_t ext2fs_open3(const char *name, const char *io_options,
> > +		       int flags, blk64_t superblock,
> >  		       unsigned int block_size, io_manager manager,
> >  		       ext2_filsys *ret_fs)
> >  {
> > diff --git a/misc/dumpe2fs.c b/misc/dumpe2fs.c
> > index ae70f70..b139977 100644
> > --- a/misc/dumpe2fs.c
> > +++ b/misc/dumpe2fs.c
> > @@ -611,7 +611,7 @@ int main (int argc, char ** argv)
> >  		for (use_blocksize = EXT2_MIN_BLOCK_SIZE;
> >  		     use_blocksize <= EXT2_MAX_BLOCK_SIZE;
> >  		     use_blocksize *= 2) {
> > -			retval = ext2fs_open (device_name, flags,
> > +			retval = ext2fs_open3(device_name, NULL, flags,
> >  					      use_superblock,
> >  					      use_blocksize, unix_io_manager,
> >  					      &fs);
> > @@ -619,7 +619,7 @@ int main (int argc, char ** argv)
> >  				break;
> >  		}
> >  	} else
> > -		retval = ext2fs_open (device_name, flags, use_superblock,
> > +		retval = ext2fs_open3(device_name, NULL, flags, use_superblock,
> >  				      use_blocksize, unix_io_manager, &fs);
> >  	if (retval) {
> >  		com_err (program_name, retval, _("while trying to open %s"),
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Mon, Sep 30, 2013 at 06:28:12PM -0700, Darrick J. Wong wrote:
> Since it's possible for very large filesystems to store backup superblocks at
> very large (> 2^32) block numbers, we need to be able to handle the case of a
> caller directing us to read one of these high-numbered backups.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Hmm... This is technically true, but I'm wondering how much we should
care.  In practice, users almost always use the first couple of backup
superblocks.  I could imagine a situation with a RAID array where the
first disk(s) were trashed, so we needed to use a backup superblock
beyond 2**32, but it's a bit unlikely.

If there was some other reason why we needed to add a new ext2fs_open3
variant, it would certainly be a good thing to fix.  But I'm wondering
if it's worth adding a new interface just for this.

Is there perhaps any other extensions to ext2fs_open() that we might
want to make, either now or in the future?

Regards,

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Tue, Oct 08, 2013 at 11:58:59AM -0400, Theodore Ts'o wrote:
> On Mon, Sep 30, 2013 at 06:28:12PM -0700, Darrick J. Wong wrote:
> > Since it's possible for very large filesystems to store backup superblocks at
> > very large (> 2^32) block numbers, we need to be able to handle the case of a
> > caller directing us to read one of these high-numbered backups.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Hmm... This is technically true, but I'm wondering how much we should
> care.  In practice, users almost always use the first couple of backup
> superblocks.  I could imagine a situation with a RAID array where the
> first disk(s) were trashed, so we needed to use a backup superblock
> beyond 2**32, but it's a bit unlikely.

True, it seems unlikely now that one would ever need to use the backup sbs
beyond 2^32, but since mke2fs is writing them there, we ought to be able to use
them.

For now, though, it's truncating the top 32 bits of a (usually) user-specified
value, so if we don't extend the API we ought to at least complain and exit.

> If there was some other reason why we needed to add a new ext2fs_open3
> variant, it would certainly be a good thing to fix.  But I'm wondering
> if it's worth adding a new interface just for this.
> 
> Is there perhaps any other extensions to ext2fs_open() that we might
> want to make, either now or in the future?

I don't have any off the top of my head, but I'll think about it.

--D
> 
> Regards,
> 
> 						- Ted
> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html