Comment 7 for bug 518582

Revision history for this message
Kees Cook (kees) wrote :

Ah, sorry, I should be comparing against the superblock, not the group_desc.

uint16_t s_ninodes;
uint16_t s_nzones;
uint32_t s_inodes_count;

uint16_t s_imap_blocks;
uint16_t s_zmap_blocks;
uint32_t s_blocks_count;

uint16_t s_firstdatazone;
uint16_t s_log_zone_size;
uint32_t s_r_blocks_count;

uint32_t s_max_size;
uint32_t s_free_blocks_count;

uint16_t s_magic;
uint32_t s_free_inodes_count;

for "sb->s_imap_blocks == 0 || sb->s_zmap_blocks == 0" to fail, the low 32bits of the ext4 max block count must be >65536 and not a multiple of 65536, so adjust the "dd" in comment 3 to:

dd if=/dev/zero of=test.ext4 bs=1 count=1 seek=1026M

this will result in non-zero values for both s_imap_blocks and s_zmap_blocks:

$ hexdump -s 0x404 -n 4 -e '2/2 "%d " "\n"' /tmp/test.ext4
512 4