From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1548383A2; Mon, 5 May 2025 09:18:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746436717; cv=none; b=CllCZzpNKLy4ewBs2OoIcpkJrjJhJY6+VwjVtTy538bXMf3ctPFs33VSAW3Fl67iqk58vHZXs4uOmS/2feg50TpI+gdFhnD1RfG8lH5TnB5VbtKt4Xs4lfUk7YME/67+zALwtkVeARMqSeUWnbkyTFX+DIIE3PBThK74+shyrMU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746436717; c=relaxed/simple; bh=dST7HgMi4u6yJTp8U9Pkyc4DA4I6fRqutLC6C05yYJE=; h=Subject:To:Cc:From:Date:In-Reply-To:Message-ID:MIME-Version: Content-Type; b=VV6kE+irm6ixrNQPkKNR0HxhO+s1+nzyCxvPAC0RGKeBvwhjUrzjWhDudNVZVFwZqLhkZ+p9pRK7Y77z0tK0j3AK9LE9WGcVoE+lV4stzLw9qeFReQleVQtLXU5Ae00yaW9mh7gPNfVXyuWQ//+VfkR/1Po7f92cBn9eEQK/xjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BoAKnBVw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="BoAKnBVw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEF27C4CEE4; Mon, 5 May 2025 09:18:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1746436717; bh=dST7HgMi4u6yJTp8U9Pkyc4DA4I6fRqutLC6C05yYJE=; h=Subject:To:Cc:From:Date:In-Reply-To:From; b=BoAKnBVwJVKh0MIFAWqFT+M32srJIKr/zL1FWoqlOFeKiUMiL3x/OGrBo9UM8edBc +QBDkxHVaMxRAo+vJ3977e+7BsvHNKj7ceEXMALLKs2MtIh6HpTJTDvN18NXxRQwjs LhKAXtu/R+nGYlEIyBs+CjyNQF5dVlUsm/ek9fUQ= Subject: Patch "xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2" has been added to the 6.1-stable tree To: catherine.hoang@oracle.com,chandan.babu@oracle.com,djwong@kernel.org,gregkh@linuxfoundation.org,hch@lst.de,leah.rumancik@gmail.com,xfs-stable@lists.linux.dev Cc: From: Date: Mon, 05 May 2025 11:18:23 +0200 In-Reply-To: <20250430212704.2905795-6-leah.rumancik@gmail.com> Message-ID: <2025050523-devotedly-caregiver-97f2@gregkh> Precedence: bulk X-Mailing-List: xfs-stable@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit X-stable: commit X-Patchwork-Hint: ignore This is a note to let you know that I've just added the patch titled xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2 to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-check-opcode-and-iovec-count-match-in-xlog_recover_attri_commit_pass2.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From stable+bounces-139232-greg=kroah.com@vger.kernel.org Wed Apr 30 23:33:04 2025 From: Leah Rumancik Date: Wed, 30 Apr 2025 14:26:52 -0700 Subject: xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2 To: stable@vger.kernel.org Cc: xfs-stable@lists.linux.dev, chandan.babu@oracle.com, catherine.hoang@oracle.com, djwong@kernel.org, Christoph Hellwig , Leah Rumancik Message-ID: <20250430212704.2905795-6-leah.rumancik@gmail.com> From: "Darrick J. Wong" [ Upstream commit ad206ae50eca62836c5460ab5bbf2a6c59a268e7 ] Check that the number of recovered log iovecs is what is expected for the xattri opcode is expecting. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Leah Rumancik Acked-by: "Darrick J. Wong" Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_attr_item.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) --- a/fs/xfs/xfs_attr_item.c +++ b/fs/xfs/xfs_attr_item.c @@ -717,6 +717,7 @@ xlog_recover_attri_commit_pass2( const void *attr_value = NULL; const void *attr_name; size_t len; + unsigned int op; attri_formatp = item->ri_buf[0].i_addr; attr_name = item->ri_buf[1].i_addr; @@ -735,6 +736,32 @@ xlog_recover_attri_commit_pass2( return -EFSCORRUPTED; } + /* Check the number of log iovecs makes sense for the op code. */ + op = attri_formatp->alfi_op_flags & XFS_ATTRI_OP_FLAGS_TYPE_MASK; + switch (op) { + case XFS_ATTRI_OP_FLAGS_SET: + case XFS_ATTRI_OP_FLAGS_REPLACE: + /* Log item, attr name, attr value */ + if (item->ri_total != 3) { + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + break; + case XFS_ATTRI_OP_FLAGS_REMOVE: + /* Log item, attr name */ + if (item->ri_total != 2) { + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + break; + default: + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, + attri_formatp, len); + return -EFSCORRUPTED; + } + /* Validate the attr name */ if (item->ri_buf[1].i_len != xlog_calc_iovec_len(attri_formatp->alfi_name_len)) { Patches currently in stable-queue which might be from leah.rumancik@gmail.com are queue-6.1/xfs-revert-commit-44af6c7e59b12.patch queue-6.1/xfs-make-the-seq-argument-to-xfs_bmapi_convert_delalloc-optional.patch queue-6.1/xfs-check-opcode-and-iovec-count-match-in-xlog_recover_attri_commit_pass2.patch queue-6.1/xfs-allow-symlinks-with-short-remote-targets.patch queue-6.1/xfs-match-lock-mode-in-xfs_buffered_write_iomap_begin.patch queue-6.1/xfs-require-xfs_sb_feat_incompat_log_xattrs-for-attr-log-intent-item-recovery.patch queue-6.1/xfs-allow-unlinked-symlinks-and-dirs-with-zero-size.patch queue-6.1/xfs-restrict-when-we-try-to-align-cow-fork-delalloc-to-cowextsz-hints.patch queue-6.1/xfs-fix-xfs_bmap_add_extent_delay_real-for-partial-conversions.patch queue-6.1/xfs-validate-recovered-name-buffers-when-recovering-xattr-items.patch queue-6.1/xfs-make-xfs_bmapi_convert_delalloc-to-allocate-the-target-offset.patch queue-6.1/xfs-convert-delayed-extents-to-unwritten-when-zeroing-post-eof-blocks.patch queue-6.1/xfs-fix-freeing-speculative-preallocations-for-preallocated-files.patch queue-6.1/xfs-make-sure-sb_fdblocks-is-non-negative.patch queue-6.1/xfs-remove-a-racy-if_bytes-check-in-xfs_reflink_end_cow_extent.patch queue-6.1/xfs-fix-error-returns-from-xfs_bmapi_write.patch