From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:58570 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751054AbdBBKTq (ORCPT ); Thu, 2 Feb 2017 05:19:46 -0500 Subject: Patch "xfs: sanity check directory inode di_size" has been added to the 4.9-stable tree To: hch@lst.de, amir73il@gmail.com, darrick.wong@oracle.com, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 02 Feb 2017 11:18:08 +0100 In-Reply-To: <1486022171-8076-8-git-send-email-hch@lst.de> Message-ID: <1486030688224176@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled xfs: sanity check directory inode di_size to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-sanity-check-directory-inode-di_size.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From hch@lst.de Thu Feb 2 11:14:03 2017 From: Christoph Hellwig Date: Thu, 2 Feb 2017 08:55:59 +0100 Subject: xfs: sanity check directory inode di_size To: stable@vger.kernel.org Cc: linux-xfs@vger.kernel.org, Amir Goldstein , "Darrick J. Wong" Message-ID: <1486022171-8076-8-git-send-email-hch@lst.de> From: Amir Goldstein commit 3c6f46eacd876bd723a9bad3c6882714c052fd8e upstream. This changes fixes an assertion hit when fuzzing on-disk i_mode values. The easy case to fix is when changing an empty file i_mode to S_IFDIR. In this case, xfs_dinode_verify() detects an illegal zero size for directory and fails to load the inode structure from disk. For the case of non empty file whose i_mode is changed to S_IFDIR, the ASSERT() statement in xfs_dir2_isblock() is replaced with return -EFSCORRUPTED, to avoid interacting with corrupted jusk also when XFS_DEBUG is disabled. Suggested-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Amir Goldstein Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- fs/xfs/libxfs/xfs_dir2.c | 3 ++- fs/xfs/libxfs/xfs_inode_buf.c | 7 +++++-- 2 files changed, 7 insertions(+), 3 deletions(-) --- a/fs/xfs/libxfs/xfs_dir2.c +++ b/fs/xfs/libxfs/xfs_dir2.c @@ -631,7 +631,8 @@ xfs_dir2_isblock( if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK))) return rval; rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize; - ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize); + if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize) + return -EFSCORRUPTED; *vp = rval; return 0; } --- a/fs/xfs/libxfs/xfs_inode_buf.c +++ b/fs/xfs/libxfs/xfs_inode_buf.c @@ -386,6 +386,7 @@ xfs_dinode_verify( struct xfs_inode *ip, struct xfs_dinode *dip) { + uint16_t mode; uint16_t flags; uint64_t flags2; @@ -396,8 +397,10 @@ xfs_dinode_verify( if (be64_to_cpu(dip->di_size) & (1ULL << 63)) return false; - /* No zero-length symlinks. */ - if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0) + mode = be16_to_cpu(dip->di_mode); + + /* No zero-length symlinks/dirs. */ + if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0) return false; /* only version 3 or greater inodes are extensively verified here */ Patches currently in stable-queue which might be from hch@lst.de are queue-4.9/xfs-don-t-rely-on-total-in-xfs_alloc_space_available.patch queue-4.9/xfs-replace-xfs_mode_to_ftype-table-with-switch-statement.patch queue-4.9/xfs-fix-bogus-minleft-manipulations.patch queue-4.9/xfs-fix-cow-writeback-race.patch queue-4.9/xfs-sanity-check-inode-mode-when-creating-new-dentry.patch queue-4.9/xfs-extsize-hints-are-not-unlikely-in-xfs_bmap_btalloc.patch queue-4.9/xfs-bump-up-reserved-blocks-in-xfs_alloc_set_aside.patch queue-4.9/xfs-add-missing-include-dependencies-to-xfs_dir2.h.patch queue-4.9/xfs-fix-bmv_count-confusion-w-shared-extents.patch queue-4.9/xfs-adjust-allocation-length-in-xfs_alloc_space_available.patch queue-4.9/xfs-verify-dirblocklog-correctly.patch queue-4.9/xfs-fix-xfs_mode_to_ftype-prototype.patch queue-4.9/xfs-clear-_xbf_pages-from-buffers-when-readahead-page.patch queue-4.9/xfs-remove-racy-hasattr-check-from-attr-ops.patch queue-4.9/xfs-make-the-assert-condition-likely.patch queue-4.9/xfs-sanity-check-directory-inode-di_size.patch queue-4.9/xfs-don-t-print-warnings-when-xfs_log_force-fails.patch queue-4.9/xfs-don-t-wrap-id-in-xfs_dq_get_next_id.patch queue-4.9/xfs-sanity-check-inode-di_mode.patch