xfs
[Top] [All Lists]

Re: xfs: prevent kernel crash due to corrupted inode log format

To: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Subject: Re: xfs: prevent kernel crash due to corrupted inode log format
From: Eric Sandeen <sandeen@xxxxxxxxxxx>
Date: Tue, 03 Mar 2009 10:28:37 -0600
Cc: xfs@xxxxxxxxxxx, Andras Korn <korn-sgi.com@xxxxxxxxxxxxxxxxxxxxxx>
In-reply-to: <20090215191344.GA16706@xxxxxxxxxxxxx>
References: <20090215191344.GA16706@xxxxxxxxxxxxx>
User-agent: Thunderbird 2.0.0.19 (Macintosh/20081209)
Christoph Hellwig wrote:
> Andras Korn reported an oops on log replay causes by a corrupted
> xfs_inode_log_format_t passing a 0 size to kmem_zalloc.  This patch handles
> to small or too large numbers of log regions gracefully by rejecting the
> log replay with a useful error message.
> 
> Signed-off-by: Christoph Hellwig <hch@xxxxxx>
> Reported-by: Andras Korn <korn-sgi.com@xxxxxxxxxxxxxxxxxxxxxx>

Reviewed-by: Eric Sandeen <sandeen@xxxxxxxxxxx>

> Index: xfs/fs/xfs/xfs_log_recover.c
> ===================================================================
> --- xfs.orig/fs/xfs/xfs_log_recover.c 2009-02-12 19:00:29.056944584 +0100
> +++ xfs/fs/xfs/xfs_log_recover.c      2009-02-15 20:07:56.568971792 +0100
> @@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
>       item = item->ri_prev;
>  
>       if (item->ri_total == 0) {              /* first region to be added */
> -             item->ri_total  = in_f->ilf_size;
> -             ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
> -             item->ri_buf = kmem_zalloc((item->ri_total *
> -                                         sizeof(xfs_log_iovec_t)), KM_SLEEP);
> +             if (in_f->ilf_size == 0 ||
> +                 in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
> +                     xlog_warn(
> +     "XFS: bad number of regions (%d) in inode log format",
> +                               in_f->ilf_size);
> +                     ASSERT(0);
> +                     return XFS_ERROR(EIO);
> +             }
> +
> +             item->ri_total = in_f->ilf_size;
> +             item->ri_buf =
> +                     kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
> +                                 KM_SLEEP);
>       }
>       ASSERT(item->ri_total > item->ri_cnt);
>       /* Description region is ri_buf[0] */
> 
> _______________________________________________
> xfs mailing list
> xfs@xxxxxxxxxxx
> http://oss.sgi.com/mailman/listinfo/xfs
> 

<Prev in Thread] Current Thread [Next in Thread>
  • Re: xfs: prevent kernel crash due to corrupted inode log format, Eric Sandeen <=