Commit a33bcad4 authored Sep 24, 2022 by Darrick J. Wong Committed by Greg Kroah-Hartman Sep 28, 2022

xfs: range check ri_cnt when recovering log items



commit d6abecb82573fed5f7e4b595b5c0bd37707d2848 upstream.

Range check the region counter when we're reassembling regions from log
items during log recovery.  In the old days ASSERT would halt the
kernel, but this isn't true any more so we have to make an explicit
error return.

Coverity-id: 1132508
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Chandan Babu R <chandan.babu@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent a102869f

fs/xfs/xfs_log_recover.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -4293,7 +4293,16 @@ xlog_recover_add_to_trans(
		kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
		0);
		}
		ASSERT(item->ri_total > item->ri_cnt);

		if (item->ri_total <= item->ri_cnt) {
		xfs_warn(log->l_mp,
		"log item region count (%d) overflowed size (%d)",
		item->ri_cnt, item->ri_total);
		ASSERT(0);
		kmem_free(ptr);
		return -EFSCORRUPTED;
		}

		/* Description region is ri_buf[0] */
		item->ri_buf[item->ri_cnt].i_addr = ptr;
		item->ri_buf[item->ri_cnt].i_len = len;