Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ff392c49 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Felix Blyakher
Browse files

xfs: prevent kernel crash due to corrupted inode log format 



Andras Korn reported an oops on log replay causes by a corrupted
xfs_inode_log_format_t passing a 0 size to kmem_zalloc.  This patch handles
to small or too large numbers of log regions gracefully by rejecting the
log replay with a useful error message.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reported-by: default avatarAndras Korn <korn-sgi.com@chardonnay.math.bme.hu>
Reviewed-by: default avatarEric Sandeen <sandeen@sandeen.net>
Signed-off-by: default avatarFelix Blyakher <felixb@sgi.com>
parent 27e88bf6

fs/xfs/xfs_log_recover.c

+13 −4
Original line number Original line Diff line number Diff line
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans( 
	item = item->ri_prev;

	item = item->ri_prev;





	if (item->ri_total == 0) {		/* first region to be added */

	if (item->ri_total == 0) {		/* first region to be added */

		if (in_f->ilf_size == 0 ||

		    in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {

			xlog_warn(

	"XFS: bad number of regions (%d) in inode log format",

				  in_f->ilf_size);

			ASSERT(0);

			return XFS_ERROR(EIO);

		}



		item->ri_total = in_f->ilf_size;

		item->ri_total = in_f->ilf_size;

		ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);

		item->ri_buf =

		item->ri_buf = kmem_zalloc((item->ri_total *

			kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),

					    sizeof(xfs_log_iovec_t)), KM_SLEEP);

				    KM_SLEEP);

	}

	}

	ASSERT(item->ri_total > item->ri_cnt);

	ASSERT(item->ri_total > item->ri_cnt);

	/* Description region is ri_buf[0] */

	/* Description region is ri_buf[0] */