From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A69821EABAD; Mon, 21 Oct 2024 10:36:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729507007; cv=none; b=YFL5mIeLfsxL4ziUGn5KVwjSdUWP9NnUdlzRiK+j5jqNtPZRQMwFHCUTmQXYCJaolkl4LMDMZJuvKpA6ya6wlpKNTEjLLR6E14jtN+oAoSYmNNx0pGyFOjwZ0xyQ4f47AXpx5ABJjs78DpbvnYBKfDqmaIGTmn1X9OdUTrU4wcU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729507007; c=relaxed/simple; bh=V/IU8NrZWvWfi38uBG01uS7vVjIAzYXld5VGSBSPo7c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lVcs4RPbY/HN2YdntPDd4TYOhVnsws35MXrjqQkunC2NNl6DEKajBytE9p8VhjIvgtzSMwAarPYklhaOnvX6pk/CrFk+4i85VXTqdSHoDdlsR70azFHjqqWUU1NgKi6VXrR3q6CfR6hZ+4I9EdwxGLil7a2iFbUhZvMWs4/6yNg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=V+gAiVOh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="V+gAiVOh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F0EAC4CEC3; Mon, 21 Oct 2024 10:36:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1729507007; bh=V/IU8NrZWvWfi38uBG01uS7vVjIAzYXld5VGSBSPo7c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V+gAiVOh6whPpgFRsDQqVusRE8JULVo+Py+qZWeBngOnorTXS3r3pLmSwC6HwTbgS cBGhJwsr5C2yz94l5BnDkKs5bGN+WwAzQFkPEtuQL8gojzXiXYS8wQYyChZV20Lut9 HhJWhihbNNw60FxXlJoxks7ruteWFEIeUl1gjbXA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-xfs@vger.kernel.org, "Darrick J. Wong" , Christoph Hellwig , Catherine Hoang Subject: [PATCH 6.6 028/124] xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2 Date: Mon, 21 Oct 2024 12:23:52 +0200 Message-ID: <20241021102257.815640292@linuxfoundation.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20241021102256.706334758@linuxfoundation.org> References: <20241021102256.706334758@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: "Darrick J. Wong" commit ad206ae50eca62836c5460ab5bbf2a6c59a268e7 upstream. Check that the number of recovered log iovecs is what is expected for the xattri opcode is expecting. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Catherine Hoang Acked-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_attr_item.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) --- a/fs/xfs/xfs_attr_item.c +++ b/fs/xfs/xfs_attr_item.c @@ -719,6 +719,7 @@ xlog_recover_attri_commit_pass2( const void *attr_value = NULL; const void *attr_name; size_t len; + unsigned int op; attri_formatp = item->ri_buf[0].i_addr; attr_name = item->ri_buf[1].i_addr; @@ -737,6 +738,32 @@ xlog_recover_attri_commit_pass2( return -EFSCORRUPTED; } + /* Check the number of log iovecs makes sense for the op code. */ + op = attri_formatp->alfi_op_flags & XFS_ATTRI_OP_FLAGS_TYPE_MASK; + switch (op) { + case XFS_ATTRI_OP_FLAGS_SET: + case XFS_ATTRI_OP_FLAGS_REPLACE: + /* Log item, attr name, attr value */ + if (item->ri_total != 3) { + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + break; + case XFS_ATTRI_OP_FLAGS_REMOVE: + /* Log item, attr name */ + if (item->ri_total != 2) { + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + break; + default: + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + /* Validate the attr name */ if (item->ri_buf[1].i_len != xlog_calc_iovec_len(attri_formatp->alfi_name_len)) {