Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55e45429 authored by Darrick J. Wong's avatar Darrick J. Wong
Browse files

xfs: btree format ifork loader should check for zero numrecs 



A btree format inode fork with zero records makes no sense, so reject it
if we see it, or else we can miscalculate memory allocations.  Found by
zeroes fuzzing {a,u3}.bmbt.numrecs in xfs/{374,378,412} with KASAN.

Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
parent 79a69bf8

fs/xfs/libxfs/xfs_inode_fork.c

+1 −0
Original line number Diff line number Diff line
@@ -298,6 +298,7 @@ xfs_iformat_btree( 
	 */

	if (unlikely(XFS_IFORK_NEXTENTS(ip, whichfork) <=

					XFS_IFORK_MAXEXT(ip, whichfork) ||

		     nrecs == 0 ||

		     XFS_BMDR_SPACE_CALC(nrecs) >

					XFS_DFORK_SIZE(dip, mp, whichfork) ||

		     XFS_IFORK_NEXTENTS(ip, whichfork) > ip->i_d.di_nblocks) ||