[PATCH v3] xfs: fix heap buffer overflow in xfs_bmbt_to_bmdr

[PATCH v3] xfs: fix heap buffer overflow in xfs_bmbt_to_bmdr

[Hongling Zeng]

The xfs_bmbt_to_bmdr() function converts an in-memory btree root to
on-disk form during log recovery. It uses bb_numrecs from the source
to determine memcpy size without validating against the destination
fork capacity.

Current code:
  dmxr = xfs_bmdr_maxrecs(dblocklen, 0);           // destination capacity
  ...
  dmxr = be16_to_cpu(dblock->bb_numrecs);          // overwrite with source value!
  memcpy(..., * dmxr);                              // may overflow destination!

If bb_numrecs is larger than the destination fork capacity,
memcpy writes beyond the fork buffer, causing heap overflow.

Fix by validating bb_numrecs against the destination capacity
before using it for memcpy operations.

Cc: stable@vger.kernel.org
Fixes: 8ea5682d0711 ("xfs: refactor log recovery item dispatch for pass2 readhead functions")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
Change in v3:
- Use dmxr for tpp calculation (on-disk format) and nrecs for memcpy (actual records)
---
Change in v2:
- Ensure memcpy operations consistently use nrecs instead of dmxr.
---
 fs/xfs/libxfs/xfs_bmap_btree.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index 758a4b1ccf5b..a119053d67b5 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -151,6 +151,7 @@ xfs_bmbt_to_bmdr(
 	int			dmxr;
 	xfs_bmbt_key_t		*fkp;
 	__be64			*fpp;
+	int                     nrecs;
 	xfs_bmbt_key_t		*tkp;
 	__be64			*tpp;
 
@@ -167,14 +168,19 @@ xfs_bmbt_to_bmdr(
 	ASSERT(rblock->bb_level != 0);
 	dblock->bb_level = rblock->bb_level;
 	dblock->bb_numrecs = rblock->bb_numrecs;
+
+	/* Validate record count against destination fork capacity */
+	nrecs = be16_to_cpu(rblock->bb_numrecs);
 	dmxr = xfs_bmdr_maxrecs(dblocklen, 0);
+	if (nrecs > dmxr)
+		return;
+
 	fkp = xfs_bmbt_key_addr(mp, rblock, 1);
 	tkp = xfs_bmdr_key_addr(dblock, 1);
 	fpp = xfs_bmap_broot_ptr_addr(mp, rblock, 1, rblocklen);
 	tpp = xfs_bmdr_ptr_addr(dblock, 1, dmxr);
-	dmxr = be16_to_cpu(dblock->bb_numrecs);
-	memcpy(tkp, fkp, sizeof(*fkp) * dmxr);
-	memcpy(tpp, fpp, sizeof(*fpp) * dmxr);
+	memcpy(tkp, fkp, sizeof(*fkp) * nrecs);
+	memcpy(tpp, fpp, sizeof(*fpp) * nrecs);
 }
 
 STATIC struct xfs_btree_cur *
-- 
2.25.1

Re: [PATCH v3] xfs: fix heap buffer overflow in xfs_bmbt_to_bmdr

[Darrick J. Wong]

Please take a breath and refrain from sending the same patch three times
in ninety minutes.  Figure out what you want to change, run it through
some testing, and only send it once you've stopped finding things to
tweak.

--D

On Thu, Jul 30, 2026 at 05:48:24PM +0800, Hongling Zeng wrote:
> The xfs_bmbt_to_bmdr() function converts an in-memory btree root to
> on-disk form during log recovery. It uses bb_numrecs from the source
> to determine memcpy size without validating against the destination
> fork capacity.
> 
> Current code:
>   dmxr = xfs_bmdr_maxrecs(dblocklen, 0);           // destination capacity
>   ...
>   dmxr = be16_to_cpu(dblock->bb_numrecs);          // overwrite with source value!
>   memcpy(..., * dmxr);                              // may overflow destination!
> 
> If bb_numrecs is larger than the destination fork capacity,
> memcpy writes beyond the fork buffer, causing heap overflow.
> 
> Fix by validating bb_numrecs against the destination capacity
> before using it for memcpy operations.
> 
> Cc: stable@vger.kernel.org
> Fixes: 8ea5682d0711 ("xfs: refactor log recovery item dispatch for pass2 readhead functions")
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
> Change in v3:
> - Use dmxr for tpp calculation (on-disk format) and nrecs for memcpy (actual records)
> ---
> Change in v2:
> - Ensure memcpy operations consistently use nrecs instead of dmxr.
> ---
>  fs/xfs/libxfs/xfs_bmap_btree.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
> index 758a4b1ccf5b..a119053d67b5 100644
> --- a/fs/xfs/libxfs/xfs_bmap_btree.c
> +++ b/fs/xfs/libxfs/xfs_bmap_btree.c
> @@ -151,6 +151,7 @@ xfs_bmbt_to_bmdr(
>  	int			dmxr;
>  	xfs_bmbt_key_t		*fkp;
>  	__be64			*fpp;
> +	int                     nrecs;
>  	xfs_bmbt_key_t		*tkp;
>  	__be64			*tpp;
>  
> @@ -167,14 +168,19 @@ xfs_bmbt_to_bmdr(
>  	ASSERT(rblock->bb_level != 0);
>  	dblock->bb_level = rblock->bb_level;
>  	dblock->bb_numrecs = rblock->bb_numrecs;
> +
> +	/* Validate record count against destination fork capacity */
> +	nrecs = be16_to_cpu(rblock->bb_numrecs);
>  	dmxr = xfs_bmdr_maxrecs(dblocklen, 0);
> +	if (nrecs > dmxr)
> +		return;
> +
>  	fkp = xfs_bmbt_key_addr(mp, rblock, 1);
>  	tkp = xfs_bmdr_key_addr(dblock, 1);
>  	fpp = xfs_bmap_broot_ptr_addr(mp, rblock, 1, rblocklen);
>  	tpp = xfs_bmdr_ptr_addr(dblock, 1, dmxr);
> -	dmxr = be16_to_cpu(dblock->bb_numrecs);
> -	memcpy(tkp, fkp, sizeof(*fkp) * dmxr);
> -	memcpy(tpp, fpp, sizeof(*fpp) * dmxr);
> +	memcpy(tkp, fkp, sizeof(*fkp) * nrecs);
> +	memcpy(tpp, fpp, sizeof(*fpp) * nrecs);
>  }
>  
>  STATIC struct xfs_btree_cur *
> -- 
> 2.25.1
> 
> 

Re: [PATCH v3] xfs: fix heap buffer overflow in xfs_bmbt_to_bmdr

[Hongling Zeng]

在 2026年07月30日 23:43, Darrick J. Wong 写道:
> Please take a breath and refrain from sending the same patch three times
> in ninety minutes.  Figure out what you want to change, run it through
> some testing, and only send it once you've stopped finding things to
> tweak.
>
> --D
   Thanks for the feedback. I apologize for the multiple versions - that 
was my mistake in not reviewing thoroughly enough before submitting.

   The v3 patch is in its final form. I would appreciate your review 
when you get a chance.

   Hongling

> On Thu, Jul 30, 2026 at 05:48:24PM +0800, Hongling Zeng wrote:
>> The xfs_bmbt_to_bmdr() function converts an in-memory btree root to
>> on-disk form during log recovery. It uses bb_numrecs from the source
>> to determine memcpy size without validating against the destination
>> fork capacity.
>>
>> Current code:
>>    dmxr = xfs_bmdr_maxrecs(dblocklen, 0);           // destination capacity
>>    ...
>>    dmxr = be16_to_cpu(dblock->bb_numrecs);          // overwrite with source value!
>>    memcpy(..., * dmxr);                              // may overflow destination!
>>
>> If bb_numrecs is larger than the destination fork capacity,
>> memcpy writes beyond the fork buffer, causing heap overflow.
>>
>> Fix by validating bb_numrecs against the destination capacity
>> before using it for memcpy operations.
>>
>> Cc: stable@vger.kernel.org
>> Fixes: 8ea5682d0711 ("xfs: refactor log recovery item dispatch for pass2 readhead functions")
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
>> ---
>> Change in v3:
>> - Use dmxr for tpp calculation (on-disk format) and nrecs for memcpy (actual records)
>> ---
>> Change in v2:
>> - Ensure memcpy operations consistently use nrecs instead of dmxr.
>> ---
>>   fs/xfs/libxfs/xfs_bmap_btree.c | 12 +++++++++---
>>   1 file changed, 9 insertions(+), 3 deletions(-)
>>
>> diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
>> index 758a4b1ccf5b..a119053d67b5 100644
>> --- a/fs/xfs/libxfs/xfs_bmap_btree.c
>> +++ b/fs/xfs/libxfs/xfs_bmap_btree.c
>> @@ -151,6 +151,7 @@ xfs_bmbt_to_bmdr(
>>   	int			dmxr;
>>   	xfs_bmbt_key_t		*fkp;
>>   	__be64			*fpp;
>> +	int                     nrecs;
>>   	xfs_bmbt_key_t		*tkp;
>>   	__be64			*tpp;
>>   
>> @@ -167,14 +168,19 @@ xfs_bmbt_to_bmdr(
>>   	ASSERT(rblock->bb_level != 0);
>>   	dblock->bb_level = rblock->bb_level;
>>   	dblock->bb_numrecs = rblock->bb_numrecs;
>> +
>> +	/* Validate record count against destination fork capacity */
>> +	nrecs = be16_to_cpu(rblock->bb_numrecs);
>>   	dmxr = xfs_bmdr_maxrecs(dblocklen, 0);
>> +	if (nrecs > dmxr)
>> +		return;
>> +
>>   	fkp = xfs_bmbt_key_addr(mp, rblock, 1);
>>   	tkp = xfs_bmdr_key_addr(dblock, 1);
>>   	fpp = xfs_bmap_broot_ptr_addr(mp, rblock, 1, rblocklen);
>>   	tpp = xfs_bmdr_ptr_addr(dblock, 1, dmxr);
>> -	dmxr = be16_to_cpu(dblock->bb_numrecs);
>> -	memcpy(tkp, fkp, sizeof(*fkp) * dmxr);
>> -	memcpy(tpp, fpp, sizeof(*fpp) * dmxr);
>> +	memcpy(tkp, fkp, sizeof(*fkp) * nrecs);
>> +	memcpy(tpp, fpp, sizeof(*fpp) * nrecs);
>>   }
>>   
>>   STATIC struct xfs_btree_cur *
>> -- 
>> 2.25.1
>>
>>