From: Christoph Hellwig <hch@lst.de>
To: stable@vger.kernel.org
Cc: linux-xfs@vger.kernel.org, "Darrick J. Wong" <darrick.wong@oracle.com>
Subject: [PATCH 07/26] xfs: check for obviously bad level values in the bmbt root
Date: Sat, 1 Apr 2017 08:34:53 +0200 [thread overview]
Message-ID: <20170401063512.25313-8-hch@lst.de> (raw)
In-Reply-To: <20170401063512.25313-1-hch@lst.de>
From: "Darrick J. Wong" <darrick.wong@oracle.com>
commit b3bf607d58520ea8c0666aeb4be60dbb724cd3a2 upstream.
We can't handle a bmbt that's taller than BTREE_MAXLEVELS, and there's
no such thing as a zero-level bmbt (for that we have extents format),
so if we see this, send back an error code.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
---
fs/xfs/libxfs/xfs_inode_fork.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 421341f93bea..25c1e078aef6 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -26,6 +26,7 @@
#include "xfs_inode.h"
#include "xfs_trans.h"
#include "xfs_inode_item.h"
+#include "xfs_btree.h"
#include "xfs_bmap_btree.h"
#include "xfs_bmap.h"
#include "xfs_error.h"
@@ -429,11 +430,13 @@ xfs_iformat_btree(
/* REFERENCED */
int nrecs;
int size;
+ int level;
ifp = XFS_IFORK_PTR(ip, whichfork);
dfp = (xfs_bmdr_block_t *)XFS_DFORK_PTR(dip, whichfork);
size = XFS_BMAP_BROOT_SPACE(mp, dfp);
nrecs = be16_to_cpu(dfp->bb_numrecs);
+ level = be16_to_cpu(dfp->bb_level);
/*
* blow out if -- fork has less extents than can fit in
@@ -446,7 +449,8 @@ xfs_iformat_btree(
XFS_IFORK_MAXEXT(ip, whichfork) ||
XFS_BMDR_SPACE_CALC(nrecs) >
XFS_DFORK_SIZE(dip, mp, whichfork) ||
- XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks)) {
+ XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks) ||
+ level == 0 || level > XFS_BTREE_MAXLEVELS) {
xfs_warn(mp, "corrupt inode %Lu (btree).",
(unsigned long long) ip->i_ino);
XFS_CORRUPTION_ERROR("xfs_iformat_btree", XFS_ERRLEVEL_LOW,
--
2.11.0
next prev parent reply other threads:[~2017-04-01 6:35 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-01 6:34 4.10-stable updates for XFS Christoph Hellwig
2017-04-01 6:34 ` [PATCH 01/26] xfs: pull up iolock from xfs_free_eofblocks() Christoph Hellwig
2017-04-01 6:34 ` [PATCH 02/26] xfs: sync eofblocks scans under iolock are livelock prone Christoph Hellwig
2017-04-01 6:34 ` [PATCH 03/26] xfs: fix eofblocks race with file extending async dio writes Christoph Hellwig
2017-04-01 6:34 ` [PATCH 04/26] xfs: fix toctou race when locking an inode to access the data map Christoph Hellwig
2017-04-01 6:34 ` [PATCH 05/26] xfs: fail _dir_open when readahead fails Christoph Hellwig
2017-04-01 6:34 ` [PATCH 06/26] xfs: filter out obviously bad btree pointers Christoph Hellwig
2017-04-01 6:34 ` Christoph Hellwig [this message]
2017-04-01 6:34 ` [PATCH 08/26] xfs: verify free block header fields Christoph Hellwig
2017-04-01 6:34 ` [PATCH 09/26] xfs: allow unwritten extents in the CoW fork Christoph Hellwig
2017-04-01 6:34 ` [PATCH 10/26] xfs: mark speculative prealloc CoW fork extents unwritten Christoph Hellwig
2017-04-01 6:34 ` [PATCH 11/26] xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t Christoph Hellwig
2017-04-01 6:34 ` [PATCH 12/26] xfs: reject all unaligned direct writes to reflinked files Christoph Hellwig
2017-04-01 17:21 ` Greg KH
2017-04-01 17:22 ` Christoph Hellwig
2017-04-01 17:26 ` Greg KH
2017-04-01 17:42 ` Christoph Hellwig
2017-04-01 6:34 ` [PATCH 13/26] xfs: update ctime and mtime on clone destinatation inodes Christoph Hellwig
2017-04-01 6:35 ` [PATCH 14/26] xfs: correct null checks and error processing in xfs_initialize_perag Christoph Hellwig
2017-04-01 6:35 ` [PATCH 15/26] xfs: don't fail xfs_extent_busy allocation Christoph Hellwig
2017-04-01 6:35 ` [PATCH 16/26] xfs: handle indlen shortage on delalloc extent merge Christoph Hellwig
2017-04-01 6:35 ` [PATCH 17/26] xfs: split indlen reservations fairly when under reserved Christoph Hellwig
2017-04-01 6:35 ` [PATCH 18/26] xfs: fix uninitialized variable in _reflink_convert_cow Christoph Hellwig
2017-04-01 6:35 ` [PATCH 19/26] xfs: don't reserve blocks for right shift transactions Christoph Hellwig
2017-04-01 6:35 ` [PATCH 20/26] xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment Christoph Hellwig
2017-04-01 6:35 ` [PATCH 21/26] xfs: tune down agno asserts in the bmap code Christoph Hellwig
2017-04-01 6:35 ` [PATCH 22/26] xfs: only reclaim unwritten COW extents periodically Christoph Hellwig
2017-04-01 6:35 ` [PATCH 23/26] xfs: fix and streamline error handling in xfs_end_io Christoph Hellwig
2017-04-01 6:35 ` [PATCH 24/26] xfs: Use xfs_icluster_size_fsb() to calculate inode alignment mask Christoph Hellwig
2017-04-01 6:35 ` [PATCH 25/26] xfs: use iomap new flag for newly allocated delalloc blocks Christoph Hellwig
2017-04-01 6:35 ` [PATCH 26/26] xfs: try any AG when allocating the first btree block when reflinking Christoph Hellwig
2017-04-01 7:43 ` 4.10-stable updates for XFS Eryu Guan
2017-04-01 13:37 ` Christoph Hellwig
2017-04-01 17:32 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2017-03-27 8:38 Christoph Hellwig
2017-03-27 8:38 ` [PATCH 07/26] xfs: check for obviously bad level values in the bmbt root Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170401063512.25313-8-hch@lst.de \
--to=hch@lst.de \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).