From: Brian Foster <bfoster@redhat.com>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: linux-xfs@vger.kernel.org
Subject: Re: [PATCH 5/5] xfs: btree format ifork loader should check for zero numrecs
Date: Mon, 15 Jan 2018 09:42:17 -0500 [thread overview]
Message-ID: <20180115144216.GE47688@bfoster.bfoster> (raw)
In-Reply-To: <151579467015.8694.7629126647166170386.stgit@magnolia>
On Fri, Jan 12, 2018 at 02:04:30PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> A btree format inode fork with zero records makes no sense, so reject it
> if we see it, or else we can miscalculate memory allocations. Found by
> zeroes fuzzing {a,u3}.bmbt.numrecs in xfs/{374,378,412} with KASAN.
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
Reviewed-by: Brian Foster <bfoster@redhat.com>
> fs/xfs/libxfs/xfs_inode_fork.c | 1 +
> 1 file changed, 1 insertion(+)
>
>
> diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
> index 84eaf17..8c01dd5 100644
> --- a/fs/xfs/libxfs/xfs_inode_fork.c
> +++ b/fs/xfs/libxfs/xfs_inode_fork.c
> @@ -307,6 +307,7 @@ xfs_iformat_btree(
> */
> if (unlikely(XFS_IFORK_NEXTENTS(ip, whichfork) <=
> XFS_IFORK_MAXEXT(ip, whichfork) ||
> + nrecs == 0 ||
> XFS_BMDR_SPACE_CALC(nrecs) >
> XFS_DFORK_SIZE(dip, mp, whichfork) ||
> XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks) ||
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
prev parent reply other threads:[~2018-01-15 14:42 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-12 22:03 [PATCH 0/5] xfs: kasan/ubsan fixes Darrick J. Wong
2018-01-12 22:04 ` [PATCH 1/5] xfs: check sb_agblocks and sb_agblklog when validating superblock Darrick J. Wong
2018-01-15 14:41 ` Brian Foster
2018-01-15 19:49 ` Darrick J. Wong
2018-01-15 20:03 ` [PATCH v2 " Darrick J. Wong
2018-01-15 21:31 ` Dave Chinner
2018-01-16 7:00 ` Darrick J. Wong
2018-01-16 12:48 ` Brian Foster
2018-01-16 17:34 ` Darrick J. Wong
2018-01-16 18:02 ` Brian Foster
2018-01-16 21:10 ` Darrick J. Wong
2018-01-17 1:20 ` [PATCH v3 " Darrick J. Wong
2018-01-17 12:55 ` Brian Foster
2018-01-12 22:04 ` [PATCH 2/5] xfs: don't iunlock unlocked inodes Darrick J. Wong
2018-01-15 14:41 ` Brian Foster
2018-01-12 22:04 ` [PATCH 3/5] xfs: directory scrubber must walk through data block to offset Darrick J. Wong
2018-01-15 14:41 ` Brian Foster
2018-01-15 19:53 ` Darrick J. Wong
2018-01-15 20:04 ` [PATCH v2 " Darrick J. Wong
2018-01-15 21:56 ` Dave Chinner
2018-01-16 7:01 ` Darrick J. Wong
2018-01-16 23:30 ` [PATCH v3 " Darrick J. Wong
2018-01-17 0:29 ` Dave Chinner
2018-01-12 22:04 ` [PATCH 4/5] xfs: attr leaf verifier needs to check for obviously bad count Darrick J. Wong
2018-01-15 14:42 ` Brian Foster
2018-01-15 19:59 ` Darrick J. Wong
2018-01-15 20:05 ` [PATCH v2 " Darrick J. Wong
2018-01-16 12:50 ` Brian Foster
2018-01-16 23:32 ` Darrick J. Wong
2018-01-12 22:04 ` [PATCH 5/5] xfs: btree format ifork loader should check for zero numrecs Darrick J. Wong
2018-01-15 14:42 ` Brian Foster [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180115144216.GE47688@bfoster.bfoster \
--to=bfoster@redhat.com \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.