From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com [209.85.208.51]) by mx.groups.io with SMTP id smtpd.web10.106203.1674836103219112048 for ; Fri, 27 Jan 2023 08:15:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=JeTXrtnn; spf=pass (domain: gmail.com, ip: 209.85.208.51, mailfrom: savvamtr@gmail.com) Received: by mail-ed1-f51.google.com with SMTP id x7so1943401edr.0 for ; Fri, 27 Jan 2023 08:15:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=PRN7B+5KvjLygblQ4uFCacE60S6AzyiRZjdCy5PW4Zs=; b=JeTXrtnnVIjjnnA0hyvVNbeZO69jyTLhjtOAwpDdn/T/Yrs5KoGWie0BrHoN7IoC3W VfLYP9LEdwZPWGTkx4BtcMKz9vsjWz/6tMgjF5EstoA9/nEOIltzL0kWkLoeeM87fhQ5 9qkoE9b4vAo9gW0T0PAQURTspPtY12kqPlA4p83NWhdyLwMn6giAjsTcO7S7AUyHuFQG OWvqXLKeo+OLbNR/HGNLD+pS3sTyX5DvTJnjGLsKAaVScJq5WRW2BtVGztUTAmA/l3qI Ck6gliZeFBe8ZJfTop1+zTtC1cJDouenV9R/hkXJG3vQsDYhubHBrEWTdzwJBWBabDuc ZS6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=PRN7B+5KvjLygblQ4uFCacE60S6AzyiRZjdCy5PW4Zs=; b=orPetjDsby3VesJxD5LXUWN6RdCZ4fp1bZGfTro8Rfmd1LqrOIJNusTSp+P4X833k4 dOMig7HbLb7Qmv4jaV1C8zfXcBs8hRtk4QKvkQXACm0iXj56bWO52sz1iamp+3DgUO0D OrCGa6fwdW8y/I2ot/fC7WLkmtKlkzPIQ31bL9y7Ifg2wFb+E9GBT9lVHOD74CBCI/lN 2sNvo6Z/u9UClwDYVqlDwYPrwD2Tm/W2zUj8fbaguf7qCzv51Fbm9ni9j7DTPcaYbLII vqhuvUgVkcN7jmcEDz+2ijwVDnPBmpce/KFGV/RqAtWciq4vtJNd4s+WpEmEmGRvIBfB tRmQ== X-Gm-Message-State: AFqh2kqOJLESyiL5Dzyu8Dk0CIzq7uZA50KVFU+o12vKpP+YHV0Mb06l 8nHYD5mUGVhLBPWbbc4MEt5LAxC4/oxSwMiK X-Google-Smtp-Source: AMrXdXsTTsO45XYcjW4zg/Mg3nO6wULrU3MrHBJuT2o/lc33wbzw+yUXmRnmnjWE5TnxQ7t+o/4hVg== X-Received: by 2002:a05:6402:501e:b0:472:1436:73ab with SMTP id p30-20020a056402501e00b00472143673abmr48271280eda.28.1674836101825; Fri, 27 Jan 2023 08:15:01 -0800 (PST) Return-Path: Received: from smtpclient.apple ([109.194.121.137]) by smtp.gmail.com with ESMTPSA id p2-20020a05640210c200b00499e5659988sm2479525edu.68.2023.01.27.08.15.00 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 27 Jan 2023 08:15:01 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\)) Subject: Re: [edk2-platforms][PATCH v3 05/11] Ext4Pkg: Fix shift out of bounds in Ext4OpenSuperblock From: "Savva Mitrofanov" In-Reply-To: Date: Fri, 27 Jan 2023 22:14:59 +0600 Cc: devel@edk2.groups.io, =?utf-8?Q?Marvin_H=C3=A4user?= , =?utf-8?B?0JLQuNGC0LDQu9C40Lkg0K7RgNGM0LXQstC40Ycg0KfQtdC/0YbQvtCy?= Message-Id: References: <20230127092945.94389-1-savvamtr@gmail.com> <20230127092945.94389-6-savvamtr@gmail.com> To: Pedro Falcato X-Mailer: Apple Mail (2.3696.120.41.1.1) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks, I corrected this in the referenced repository fork. Will be included in v4. > On 27 Jan 2023, at 20:22, Pedro Falcato = wrote: >=20 > On Fri, Jan 27, 2023 at 9:29 AM Savva Mitrofanov = wrote: >>=20 >> Missing check for wrong s_log_block_size exponent leads to shift out = of >> bounds. Limit block size to 2 MiB >>=20 >> Cc: Marvin H=C3=A4user >> Cc: Pedro Falcato >> Cc: Vitaly Cheptsov >> Fixes: d9ceedca6c8f ("Ext4Pkg: Add Ext4Dxe driver.") >> Signed-off-by: Savva Mitrofanov >> --- >> Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h | 14 ++++++++++++++ >> Features/Ext4Pkg/Ext4Dxe/Superblock.c | 5 +++++ >> 2 files changed, 19 insertions(+) >>=20 >> diff --git a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h = b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h >> index 2e489ce4dd86..a23323319a59 100644 >> --- a/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h >> +++ b/Features/Ext4Pkg/Ext4Dxe/Ext4Dxe.h >> @@ -40,6 +40,20 @@ >> #define EXT4_EFI_PATH_MAX 4096 >> #define EXT4_DRIVER_VERSION 0x0000 >>=20 >> +// >> +// The EXT4 Specification doesn't strictly limit block size and this = value could be up to 2^31, >> +// but in practice it is limited by PAGE_SIZE due to performance = significant impact. >> +// Many EXT4 implementations have size of block limited to = PAGE_SIZE. In many cases it's limited >> +// to 4096, which is a commonly supported page size on most = MMU-capable hardware, and up to 65536. >> +// So, to take a balance between compatibility and security = measures, it is decided to use the >> +// value of 2MiB as the limit, which is equal to page size on new = hardware. > Nit: s/page size/large page size/ > I can change this for you when pushing, no need for a v4 on this one. >> +// As for supporting big block sizes, EXT4 has a RO_COMPAT_FEATURE = called BIGALLOC, which changes >> +// EXT4 to use clustered allocation, so that each bit in the ext4 = block allocation bitmap addresses >> +// a power of two number of blocks. So it would be wiser to = implement and use this feature >> +// if there is such a need instead of big block size. >> +// >> +#define EXT4_LOG_BLOCK_SIZE_MAX 11 >> + >> /** >> Opens an ext4 partition and installs the Simple File System = protocol. >>=20 >> diff --git a/Features/Ext4Pkg/Ext4Dxe/Superblock.c = b/Features/Ext4Pkg/Ext4Dxe/Superblock.c >> index be3527e4d618..3f56de93c105 100644 >> --- a/Features/Ext4Pkg/Ext4Dxe/Superblock.c >> +++ b/Features/Ext4Pkg/Ext4Dxe/Superblock.c >> @@ -248,6 +248,11 @@ Ext4OpenSuperblock ( >> return EFI_VOLUME_CORRUPTED; >> } >>=20 >> + if (Sb->s_log_block_size > EXT4_LOG_BLOCK_SIZE_MAX) { >> + DEBUG ((DEBUG_ERROR, "[ext4] SuperBlock s_log_block_size %lu is = too big\n", Sb->s_log_block_size)); >> + return EFI_UNSUPPORTED; >> + } >> + >> Partition->BlockSize =3D (UINT32)LShiftU64 (1024, = Sb->s_log_block_size); >>=20 >> // The size of a block group can also be calculated as 8 * = Partition->BlockSize >> -- >> 2.39.0 >>=20 >=20 > Reviewed-by: Pedro Falcato >=20 > --=20 > Pedro