On Wed, Jul 23, 2008 at 05:52:24PM +1000, Barry Naujok wrote:
> This one is mainly for Dave...
>
> In xfs_alloc_read_agf() in xfs_alloc.c, the current user-space version
> checks:
>
> agf_ok = ...
> be32_to_cpu(agf->agf_btreeblks) <= be32_to_cpu(agf->agf_length) &&
> ...
>
> but the kernel version doesn't.
>
> Is this an oversight with the lazy-counter code in the kernel, remove from
> user-space or leave them different?
Oversight in the kernel code. Patch below.
Cheers,
Dave.
--
Dave Chinner
david@xxxxxxxxxxxxx
Check that the number of AGF btree blocks is within a sane bound
when reading the AGF. Noticed by Barry Naujok.
Signed-off-by: Dave Chinner <david@xxxxxxxxxxxxx>
---
fs/xfs/xfs_alloc.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 1956f83..a85bf20 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -2185,6 +2185,7 @@ xfs_alloc_read_agf(
be32_to_cpu(agf->agf_magicnum) == XFS_AGF_MAGIC &&
XFS_AGF_GOOD_VERSION(be32_to_cpu(agf->agf_versionnum)) &&
be32_to_cpu(agf->agf_freeblks) <= be32_to_cpu(agf->agf_length)
&&
+ be32_to_cpu(agf->agf_btreeblks) <= be32_to_cpu(agf->agf_length)
&&
be32_to_cpu(agf->agf_flfirst) < XFS_AGFL_SIZE(mp) &&
be32_to_cpu(agf->agf_fllast) < XFS_AGFL_SIZE(mp) &&
be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp);
|