Re: [PATCH] xfs: catch invalid negative blknos in _xfs_buf_find()

Mark Tinguely
2014-11-26T16:38:11Z

On 11/19/14 16:12, Eric Sandeen wrote:
> Here blkno is a daddr_t, which is a __s64; it's possible to hold
> a value which is negative, and thus pass the (blkno>= eofs)
> test. Then we try to do a xfs_perag_get() for a ridiculous
> agno via xfs_daddr_to_agno(), and bad things happen when that
> fails, and returns a null pag which is dereferenced shortly
> thereafter.
>
> Found via a user-supplied fuzzed image...
>
> Signed-off-by: Eric Sandeen<sandeen@redhat.com>
> ---

Looks good.

I did a little playing with sending the try lock failure (EAGAIN?) and
EFSCORRUPT error status up the stack. It looked straight forward and
could save a xfs_buf allocation when we know it is not necessary.

Reviewed-by: Mark Tinguely <tinguely@sgi.com>