Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3228149c authored by Dave Chinner's avatar Dave Chinner Committed by Felix Blyakher
Browse files

xfs: Check buffer lengths in log recovery 



Before trying to obtain, read or write a buffer,
check that the buffer length is actually valid. If
it is not valid, then something read in the recovery
process has been corrupted and we should abort
recovery.

Reported-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Tested-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Reviewed-by: default avatarChristoph Hellwig <hch@infradead.org>
Reviewed-by: default avatarFelix Blyakher <felixb@sgi.com>
Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
Signed-off-by: default avatarFelix Blyakher <felixb@sgi.com>
parent ed7b44af

fs/xfs/xfs_log_recover.c

+25 −6
Original line number Diff line number Diff line
@@ -70,16 +70,21 @@ STATIC void xlog_recover_check_summary(xlog_t *); 
xfs_buf_t *

xlog_get_bp(

	xlog_t		*log,

	int		num_bblks)

	int		nbblks)

{

	ASSERT(num_bblks > 0);

	if (nbblks <= 0 || nbblks > log->l_logBBsize) {

		xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);

		XFS_ERROR_REPORT("xlog_get_bp(1)",

				 XFS_ERRLEVEL_HIGH, log->l_mp);

		return NULL;

	}



	if (log->l_sectbb_log) {

		if (num_bblks > 1)

			num_bblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);

		num_bblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, num_bblks);

		if (nbblks > 1)

			nbblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);

		nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);

	}

	return xfs_buf_get_noaddr(BBTOB(num_bblks), log->l_mp->m_logdev_targp);

	return xfs_buf_get_noaddr(BBTOB(nbblks), log->l_mp->m_logdev_targp);

}



void
@@ -102,6 +107,13 @@ xlog_bread( 
{

	int		error;



	if (nbblks <= 0 || nbblks > log->l_logBBsize) {

		xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);

		XFS_ERROR_REPORT("xlog_bread(1)",

				 XFS_ERRLEVEL_HIGH, log->l_mp);

		return EFSCORRUPTED;

	}



	if (log->l_sectbb_log) {

		blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);

		nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
@@ -139,6 +151,13 @@ xlog_bwrite( 
{

	int		error;



	if (nbblks <= 0 || nbblks > log->l_logBBsize) {

		xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);

		XFS_ERROR_REPORT("xlog_bwrite(1)",

				 XFS_ERRLEVEL_HIGH, log->l_mp);

		return EFSCORRUPTED;

	}



	if (log->l_sectbb_log) {

		blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);

		nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);