Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5f460b1 authored by Darrick J. Wong's avatar Darrick J. Wong
Browse files

xfs: check that br_blockcount doesn't overflow 



xfs_bmbt_irec.br_blockcount is declared as xfs_filblks_t, which is an
unsigned 64-bit integer.  Though the bmbt helpers will never set a value
larger than 2^21 (since the underlying on-disk extent record has a
length field that is only 21 bits wide), we should be a little defensive
about checking that a bmbt record doesn't exceed what we're expecting or
overflow into the next AG.

Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>
parent 55e45429

fs/xfs/scrub/bmap.c

+9 −4
Original line number Diff line number Diff line
@@ -305,6 +305,7 @@ xfs_scrub_bmap_extent( 
{

	struct xfs_mount		*mp = info->sc->mp;

	struct xfs_buf			*bp = NULL;

	xfs_filblks_t			end;

	int				error = 0;



	if (cur)
@@ -332,19 +333,23 @@ xfs_scrub_bmap_extent( 
				irec->br_startoff);



	/* Make sure the extent points to a valid place. */

	if (irec->br_blockcount > MAXEXTLEN)

		xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,

				irec->br_startoff);

	if (irec->br_startblock + irec->br_blockcount <= irec->br_startblock)

		xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,

				irec->br_startoff);

	end = irec->br_startblock + irec->br_blockcount - 1;

	if (info->is_rt &&

	    (!xfs_verify_rtbno(mp, irec->br_startblock) ||

	     !xfs_verify_rtbno(mp, irec->br_startblock +

				irec->br_blockcount - 1)))

	     !xfs_verify_rtbno(mp, end)))

		xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,

				irec->br_startoff);

	if (!info->is_rt &&

	    (!xfs_verify_fsbno(mp, irec->br_startblock) ||

	     !xfs_verify_fsbno(mp, irec->br_startblock +

				irec->br_blockcount - 1)))

	     !xfs_verify_fsbno(mp, end) ||

	     XFS_FSB_TO_AGNO(mp, irec->br_startblock) !=

				XFS_FSB_TO_AGNO(mp, end)))

		xfs_scrub_fblock_set_corrupt(info->sc, info->whichfork,

				irec->br_startoff);