<div dir="ltr"><div>Hey Thadeu, <br></div><div><br></div><div>It looks like the git cherry-pick happened to auto merge it in the correct way and I did not question it :) <br></div><div><br></div><div>Thanks for the review, <br></div><div><br></div><div>- Luke<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 30, 2021 at 12:06 PM Thadeu Lima de Souza Cascardo <<a href="mailto:cascardo@canonical.com">cascardo@canonical.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Thu, Sep 30, 2021 at 11:28:46AM -0700, Luke Nowakowski-Krijger wrote:<br> > From: Wang Xiaojun <<a href="mailto:wangxiaojun11@huawei.com" target="_blank">wangxiaojun11@huawei.com</a>><br> > <br> > Meta area is not included in section_count computation.<br> > So the minimum number of total_sections is 1 meanwhile it cannot be<br> > greater than segment_count_main.<br> > <br> > The minimum number of meta segments is 8 (SB + 2 (CP + SIT + NAT) + SSA).<br> > <br> > Signed-off-by: Wang Xiaojun <<a href="mailto:wangxiaojun11@huawei.com" target="_blank">wangxiaojun11@huawei.com</a>><br> > Reviewed-by: Chao Yu <<a href="mailto:yuchao0@huawei.com" target="_blank">yuchao0@huawei.com</a>><br> > Signed-off-by: Jaegeuk Kim <<a href="mailto:jaegeuk@kernel.org" target="_blank">jaegeuk@kernel.org</a>><br> > (cherry-picked from f99ba9add67ce63eca3fe68a3d5e9996cd2c33b5)<br> > CVE-2019-19449<br> <br> Hey, Luke.<br> <br> Didn't this commit require a conflict fix due to f2fs_msg vs f2fs_info/f2fs_err<br> as well? It looks like it didn't, as I just tested it.<br> <br> Again, thanks for the work.<br> <br> Acked-by: Thadeu Lima de Souza Cascardo <<a href="mailto:cascardo@canonical.com" target="_blank">cascardo@canonical.com</a>><br> <br> > Signed-off-by: Luke Nowakowski-Krijger <<a href="mailto:luke.nowakowskikrijger@canonical.com" target="_blank">luke.nowakowskikrijger@canonical.com</a>><br> > ---<br> > fs/f2fs/segment.h | 1 +<br> > fs/f2fs/super.c | 8 ++++----<br> > 2 files changed, 5 insertions(+), 4 deletions(-)<br> > <br> > diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h<br> > index 135e14f9bfbd..dbc9549ef0a4 100644<br> > --- a/fs/f2fs/segment.h<br> > +++ b/fs/f2fs/segment.h<br> > @@ -19,6 +19,7 @@<br> > #define DEF_MAX_RECLAIM_PREFREE_SEGMENTS 4096 /* 8GB in maximum */<br> > <br> > #define F2FS_MIN_SEGMENTS 9 /* SB + 2 (CP + SIT + NAT) + SSA + MAIN */<br> > +#define F2FS_MIN_META_SEGMENTS 8 /* SB + 2 (CP + SIT + NAT) + SSA */<br> > <br> > /* L: Logical segment # in volume, R: Relative segment # in main area */<br> > #define GET_L2R_SEGNO(free_i, segno) ((segno) - (free_i)->start_segno)<br> > diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c<br> > index d51f78df2c57..9eba35db374c 100644<br> > --- a/fs/f2fs/super.c<br> > +++ b/fs/f2fs/super.c<br> > @@ -1970,7 +1970,7 @@ static inline bool sanity_check_area_boundary(struct f2fs_sb_info *sbi,<br> > static int sanity_check_raw_super(struct f2fs_sb_info *sbi,<br> > struct buffer_head *bh)<br> > {<br> > - block_t segment_count, segs_per_sec, secs_per_zone;<br> > + block_t segment_count, segs_per_sec, secs_per_zone, segment_count_main;<br> > block_t total_sections, blocks_per_seg;<br> > struct f2fs_super_block *raw_super = (struct f2fs_super_block *)<br> > (bh->b_data + F2FS_SUPER_OFFSET);<br> > @@ -2029,6 +2029,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,<br> > }<br> > <br> > segment_count = le32_to_cpu(raw_super->segment_count);<br> > + segment_count_main = le32_to_cpu(raw_super->segment_count_main);<br> > segs_per_sec = le32_to_cpu(raw_super->segs_per_sec);<br> > secs_per_zone = le32_to_cpu(raw_super->secs_per_zone);<br> > total_sections = le32_to_cpu(raw_super->section_count);<br> > @@ -2044,8 +2045,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,<br> > return -EFSCORRUPTED;<br> > }<br> > <br> > - if (total_sections > segment_count ||<br> > - total_sections < F2FS_MIN_SEGMENTS ||<br> > + if (total_sections > segment_count_main || total_sections < 1 ||<br> > segs_per_sec > segment_count || !segs_per_sec) {<br> > f2fs_msg(sb, KERN_INFO,<br> > "Invalid segment/section count (%u, %u x %u)",<br> > @@ -2139,7 +2139,7 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)<br> > ovp_segments = le32_to_cpu(ckpt->overprov_segment_count);<br> > reserved_segments = le32_to_cpu(ckpt->rsvd_segment_count);<br> > <br> > - if (unlikely(fsmeta < F2FS_MIN_SEGMENTS ||<br> > + if (unlikely(fsmeta < F2FS_MIN_META_SEGMENTS ||<br> > ovp_segments == 0 || reserved_segments == 0)) {<br> > f2fs_msg(sbi->sb, KERN_ERR,<br> > "Wrong layout: check mkfs.f2fs version");<br> > -- <br> > 2.30.2<br> > <br> > <br> > -- <br> > kernel-team mailing list<br> > <a href="mailto:kernel-team@lists.ubuntu.com" target="_blank">kernel-team@lists.ubuntu.com</a><br> > <a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a><br> </blockquote></div></div>