diff options
| author | Darrick J. Wong <darrick.wong@oracle.com> | 2018-03-23 10:06:51 -0700 |
|---|---|---|
| committer | Darrick J. Wong <darrick.wong@oracle.com> | 2018-03-23 18:05:07 -0700 |
| commit | 6915ef35c0350e87a104cb4c4ab2121c81ca7a34 (patch) | |
| tree | b69db4b59599ceb73769e1c593326a9707ba9998 /fs/xfs/libxfs/xfs_dir2_node.c | |
| parent | a27ba2607e60312554cbcd43fc660b2c7f29dc9c (diff) | |
| download | linux-6915ef35c0350e87a104cb4c4ab2121c81ca7a34.tar.gz linux-6915ef35c0350e87a104cb4c4ab2121c81ca7a34.tar.bz2 linux-6915ef35c0350e87a104cb4c4ab2121c81ca7a34.zip | |
xfs: sanity-check the unused space before trying to use it
In xfs_dir2_data_use_free, we examine on-disk metadata and ASSERT if
it doesn't make sense. Since a carefully crafted fuzzed image can cause
the kernel to crash after blowing a bunch of assertions, let's move
those checks into a validator function and rig everything up to return
EFSCORRUPTED to userspace. Found by lastbit fuzzing ltail.bestcount via
xfs/391.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Diffstat (limited to 'fs/xfs/libxfs/xfs_dir2_node.c')
| -rw-r--r-- | fs/xfs/libxfs/xfs_dir2_node.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c index 0839ffe27e02..9df096cc3c37 100644 --- a/fs/xfs/libxfs/xfs_dir2_node.c +++ b/fs/xfs/libxfs/xfs_dir2_node.c @@ -1729,6 +1729,7 @@ xfs_dir2_node_addname_int( __be16 *bests; struct xfs_dir3_icfree_hdr freehdr; struct xfs_dir2_data_free *bf; + xfs_dir2_data_aoff_t aoff; dp = args->dp; mp = dp->i_mount; @@ -2023,9 +2024,13 @@ xfs_dir2_node_addname_int( /* * Mark the first part of the unused space, inuse for us. */ - xfs_dir2_data_use_free(args, dbp, dup, - (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr), length, - &needlog, &needscan); + aoff = (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr); + error = xfs_dir2_data_use_free(args, dbp, dup, aoff, length, + &needlog, &needscan); + if (error) { + xfs_trans_brelse(tp, dbp); + return error; + } /* * Fill in the new entry and log it. */ |