[PATCH 3/3] libxfs: do not allow cache growth to overflow

[Eric Sandeen <sandeen@redhat.com>]

Nothing stops cache_expand() from growing c_maxcount (via *2)
repeatedly until it overflows.

Add a bounds check here and return failure if for any reason we try to
grow too much.

With the prior fixes, we should never get this far, but it's worth
defending against anyway.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
 libxfs/cache.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/libxfs/cache.c b/libxfs/cache.c
index 60bfcdc5..03b62bc7 100644
--- a/libxfs/cache.c
+++ b/libxfs/cache.c
@@ -79,16 +79,24 @@ cache_init(
 	return cache;
 }
 
-static void
+/* Double the cache size limit; return false if it would overflow. */
+static bool
 cache_expand(
 	struct cache *		cache)
 {
+	bool			expanded = false;
+
 	pthread_mutex_lock(&cache->c_mutex);
+	if (cache->c_maxcount <= UINT_MAX / 2) {
 #ifdef CACHE_DEBUG
-	fprintf(stderr, "doubling cache size to %u\n", 2 * cache->c_maxcount);
+		fprintf(stderr, "doubling cache size to %u\n",
+				2 * cache->c_maxcount);
 #endif
-	cache->c_maxcount *= 2;
+		cache->c_maxcount *= 2;
+		expanded = true;
+	}
 	pthread_mutex_unlock(&cache->c_mutex);
+	return expanded;
 }
 
 void
@@ -375,7 +383,8 @@ __cache_node_purge(
  * Otherwise, we allocate a new node, taking care not to expand the
  * cache beyond the requested maximum size (shrink it if it would).
  * Returns zero if hit in cache, one if a new node was allocated.  Returns
- * -ENOMEM if allocation fails after cache shaking is exhausted.
+ * -ENOMEM if allocation fails after cache shaking is exhausted, or if the
+ * cache cannot be expanded further without overflowing.
  */
 int
 cache_node_get(
@@ -485,8 +494,9 @@ next_object:
 			 */
 			if (error < 0)
 				return error;
+			if (!cache_expand(cache))
+				return -ENOMEM;
 			priority = 0;
-			cache_expand(cache);
 		}
 	}
 
-- 
2.55.0