libext2fs: reject various bitmap and inode operations for journal_dev file systems

The ext2fs_open() function will only allow journal_dev file systems to
be open if explicitly requested by programs using the
EXT2_FLAG_JOURNAL_DEV_OK flag.  Those programs will not try to call
functions that make no sense, such as ext2fs_read_inode(),
ext2fs_read_bitmaps(), etc.  Just to make things the library more
robust against buggy programs (or unrealistic fuzzers) add a check for
journal_dev file systems to various ext2fs library functions to return
a new error, EXT2_ET_EXTERNAL_JOURNAL_NOSUPP.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

4 files changed, 26 insertions, 0 deletions

diff --git a/lib/ext2fs/bitmaps.c b/lib/ext2fs/bitmaps.c
index 834a3962a..8bfa24b1e 100644
--- a/lib/ext2fs/bitmaps.c
+++ b/lib/ext2fs/bitmaps.c
@@ -58,6 +58,9 @@ errcode_t ext2fs_allocate_inode_bitmap(ext2_filsys fs,
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
 
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	fs->write_bitmaps = ext2fs_write_bitmaps;
 
 	start = 1;
@@ -91,6 +94,9 @@ errcode_t ext2fs_allocate_block_bitmap(ext2_filsys fs,
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
 
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	fs->write_bitmaps = ext2fs_write_bitmaps;
 
 	start = EXT2FS_B2C(fs, fs->super->s_first_data_block);
@@ -131,6 +137,9 @@ errcode_t ext2fs_allocate_subcluster_bitmap(ext2_filsys fs,
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
 
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	fs->write_bitmaps = ext2fs_write_bitmaps;
 
 	if (!fs->cluster_ratio_bits)
diff --git a/lib/ext2fs/ext2_err.et.in b/lib/ext2fs/ext2_err.et.in
index bb1dcf149..de1401981 100644
--- a/lib/ext2fs/ext2_err.et.in
+++ b/lib/ext2fs/ext2_err.et.in
@@ -554,4 +554,7 @@ ec	EXT2_FILSYS_CORRUPTED,
 ec	EXT2_ET_EXTENT_CYCLE,
 	"Found cyclic loop in extent tree"
 
+ec	EXT2_ET_EXTERNAL_JOURNAL_NOSUPP,
+	"Operation not supported on an external journal"
+
 	end
diff --git a/lib/ext2fs/inode.c b/lib/ext2fs/inode.c
index 6f42882ea..957d5aa9f 100644
--- a/lib/ext2fs/inode.c
+++ b/lib/ext2fs/inode.c
@@ -144,6 +144,10 @@ errcode_t ext2fs_open_inode_scan(ext2_filsys fs, int buffer_blocks,
 	errcode_t (*save_get_blocks)(ext2_filsys f, ext2_ino_t ino, blk_t *blocks);
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	if (fs->blocksize < 1024)
 		return EXT2_FILSYS_CORRUPTED; /* Should never happen */
 
@@ -766,6 +770,10 @@ errcode_t ext2fs_read_inode2(ext2_filsys fs, ext2_ino_t ino,
 	int		cache_slot, fail_csum;
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	if (fs->blocksize < 1024)
 		return EXT2_FILSYS_CORRUPTED; /* Should never happen */
 
@@ -898,6 +906,9 @@ errcode_t ext2fs_write_inode2(ext2_filsys fs, ext2_ino_t ino,
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
 
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	/* Check to see if user provided an override function */
 	if (fs->write_inode) {
 		retval = (fs->write_inode)(fs, ino, inode);
diff --git a/lib/ext2fs/rw_bitmaps.c b/lib/ext2fs/rw_bitmaps.c
index b9e387302..7be4a55ab 100644
--- a/lib/ext2fs/rw_bitmaps.c
+++ b/lib/ext2fs/rw_bitmaps.c
@@ -535,6 +535,9 @@ errcode_t ext2fs_rw_bitmaps(ext2_filsys fs, int flags, int num_threads)
 	if (flags & ~EXT2FS_BITMAPS_VALID_FLAGS)
 		return EXT2_ET_INVALID_ARGUMENT;
 
+	if (ext2fs_has_feature_journal_dev(fs->super))
+		return EXT2_ET_EXTERNAL_JOURNAL_NOSUPP;
+
 	if (flags & EXT2FS_BITMAPS_WRITE)
 		return write_bitmaps(fs, flags & EXT2FS_BITMAPS_INODE,
 				     flags & EXT2FS_BITMAPS_BLOCK);