* xfs: prevent kernel crash due to corrupted inode log format
@ 2009-02-15 19:13 Christoph Hellwig
2009-02-16 20:35 ` Arkadiusz Miskiewicz
2009-03-03 16:28 ` Eric Sandeen
0 siblings, 2 replies; 4+ messages in thread
From: Christoph Hellwig @ 2009-02-15 19:13 UTC (permalink / raw)
To: xfs; +Cc: Andras Korn
Andras Korn reported an oops on log replay causes by a corrupted
xfs_inode_log_format_t passing a 0 size to kmem_zalloc. This patch handles
to small or too large numbers of log regions gracefully by rejecting the
log replay with a useful error message.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Andras Korn <korn-sgi.com@chardonnay.math.bme.hu>
Index: xfs/fs/xfs/xfs_log_recover.c
===================================================================
--- xfs.orig/fs/xfs/xfs_log_recover.c 2009-02-12 19:00:29.056944584 +0100
+++ xfs/fs/xfs/xfs_log_recover.c 2009-02-15 20:07:56.568971792 +0100
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
item = item->ri_prev;
if (item->ri_total == 0) { /* first region to be added */
- item->ri_total = in_f->ilf_size;
- ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
- item->ri_buf = kmem_zalloc((item->ri_total *
- sizeof(xfs_log_iovec_t)), KM_SLEEP);
+ if (in_f->ilf_size == 0 ||
+ in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
+ xlog_warn(
+ "XFS: bad number of regions (%d) in inode log format",
+ in_f->ilf_size);
+ ASSERT(0);
+ return XFS_ERROR(EIO);
+ }
+
+ item->ri_total = in_f->ilf_size;
+ item->ri_buf =
+ kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
+ KM_SLEEP);
}
ASSERT(item->ri_total > item->ri_cnt);
/* Description region is ri_buf[0] */
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: xfs: prevent kernel crash due to corrupted inode log format
2009-02-15 19:13 xfs: prevent kernel crash due to corrupted inode log format Christoph Hellwig
@ 2009-02-16 20:35 ` Arkadiusz Miskiewicz
2009-02-17 9:31 ` Christoph Hellwig
2009-03-03 16:28 ` Eric Sandeen
1 sibling, 1 reply; 4+ messages in thread
From: Arkadiusz Miskiewicz @ 2009-02-16 20:35 UTC (permalink / raw)
To: xfs; +Cc: Christoph Hellwig, Andras Korn
On Sunday 15 of February 2009, Christoph Hellwig wrote:
> Andras Korn reported an oops on log replay causes by a corrupted
Where is that report? I'm wondering if it's the same issue as I'm seeing:
http://pld.pastebin.com/f15430869
http://pld.pastebin.com/fbcdce88
--
Arkadiusz Miśkiewicz PLD/Linux Team
arekm / maven.pl http://ftp.pld-linux.org/
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: xfs: prevent kernel crash due to corrupted inode log format
2009-02-16 20:35 ` Arkadiusz Miskiewicz
@ 2009-02-17 9:31 ` Christoph Hellwig
0 siblings, 0 replies; 4+ messages in thread
From: Christoph Hellwig @ 2009-02-17 9:31 UTC (permalink / raw)
To: Arkadiusz Miskiewicz; +Cc: Christoph Hellwig, Andras Korn, xfs
On Mon, Feb 16, 2009 at 09:35:19PM +0100, Arkadiusz Miskiewicz wrote:
> On Sunday 15 of February 2009, Christoph Hellwig wrote:
> > Andras Korn reported an oops on log replay causes by a corrupted
>
> Where is that report? I'm wondering if it's the same issue as I'm seeing:
>
> http://pld.pastebin.com/f15430869
> http://pld.pastebin.com/fbcdce88
Not related at all.
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: xfs: prevent kernel crash due to corrupted inode log format
2009-02-15 19:13 xfs: prevent kernel crash due to corrupted inode log format Christoph Hellwig
2009-02-16 20:35 ` Arkadiusz Miskiewicz
@ 2009-03-03 16:28 ` Eric Sandeen
1 sibling, 0 replies; 4+ messages in thread
From: Eric Sandeen @ 2009-03-03 16:28 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Andras Korn, xfs
Christoph Hellwig wrote:
> Andras Korn reported an oops on log replay causes by a corrupted
> xfs_inode_log_format_t passing a 0 size to kmem_zalloc. This patch handles
> to small or too large numbers of log regions gracefully by rejecting the
> log replay with a useful error message.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> Reported-by: Andras Korn <korn-sgi.com@chardonnay.math.bme.hu>
Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
> Index: xfs/fs/xfs/xfs_log_recover.c
> ===================================================================
> --- xfs.orig/fs/xfs/xfs_log_recover.c 2009-02-12 19:00:29.056944584 +0100
> +++ xfs/fs/xfs/xfs_log_recover.c 2009-02-15 20:07:56.568971792 +0100
> @@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
> item = item->ri_prev;
>
> if (item->ri_total == 0) { /* first region to be added */
> - item->ri_total = in_f->ilf_size;
> - ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
> - item->ri_buf = kmem_zalloc((item->ri_total *
> - sizeof(xfs_log_iovec_t)), KM_SLEEP);
> + if (in_f->ilf_size == 0 ||
> + in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
> + xlog_warn(
> + "XFS: bad number of regions (%d) in inode log format",
> + in_f->ilf_size);
> + ASSERT(0);
> + return XFS_ERROR(EIO);
> + }
> +
> + item->ri_total = in_f->ilf_size;
> + item->ri_buf =
> + kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
> + KM_SLEEP);
> }
> ASSERT(item->ri_total > item->ri_cnt);
> /* Description region is ri_buf[0] */
>
> _______________________________________________
> xfs mailing list
> xfs@oss.sgi.com
> http://oss.sgi.com/mailman/listinfo/xfs
>
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-03-03 16:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-02-15 19:13 xfs: prevent kernel crash due to corrupted inode log format Christoph Hellwig
2009-02-16 20:35 ` Arkadiusz Miskiewicz
2009-02-17 9:31 ` Christoph Hellwig
2009-03-03 16:28 ` Eric Sandeen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox