mirros/rockchip-kernel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: detect overflows in bmbt records

Browse Source 
commit acf104c233 upstream.

Detect file block mappings with a blockcount that's either so large that
integer overflows occur or are zero, because neither are valid in the
filesystem.  Worse yet, attempting directory modifications causes the
iext code to trip over the bmbt key handling and takes the filesystem
down.  We can fix most of this by preventing the bad metadata from
entering the incore structures in the first place.

Found by setting blockcount=0 in a directory data fork mapping and
watching the fireworks.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Darrick J. Wong
2022-05-27 16:02:15 +03:00
committed by Greg Kroah-Hartman
parent ffc8d61387
commit f20e67b455
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/xfs/libxfs/xfs_bmap.c
View File

@@ -6229,6 +6229,11 @@ xfs_bmap_validate_extent(
xfs_fsblock_t endfsb;
bool isrt;
if (irec->br_startblock + irec->br_blockcount <= irec->br_startblock)
return __this_address;
if (irec->br_startoff + irec->br_blockcount <= irec->br_startoff)
return __this_address;
isrt = XFS_IS_REALTIME_INODE(ip);
endfsb = irec->br_startblock + irec->br_blockcount - 1;
if (isrt && whichfork == XFS_DATA_FORK) {