xfs
[Top] [All Lists]

[PATCH] repair: validate acl count before reading it

To: xfs@xxxxxxxxxxx
Subject: [PATCH] repair: validate acl count before reading it
From: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Date: Tue, 15 Nov 2011 03:07:15 -0500
User-agent: Mutt/1.5.21 (2010-09-15)
This prevents a segfault on a filesystem so badly corrupted by the RAID
controller that it could be considered fuzzed.

Signed-off-by: Christoph Hellwig <hch@xxxxxx>

Index: xfsprogs-dev/repair/attr_repair.c
===================================================================
--- xfsprogs-dev.orig/repair/attr_repair.c      2011-11-14 20:03:27.000000000 
+0000
+++ xfsprogs-dev/repair/attr_repair.c   2011-11-14 20:20:55.000000000 +0000
@@ -931,8 +931,8 @@ process_longform_attr(
 }
 
 
-static xfs_acl_t *
-xfs_acl_from_disk(xfs_acl_disk_t *dacl)
+static int
+xfs_acl_from_disk(struct xfs_acl **aclp, struct xfs_acl_disk *dacl)
 {
        int                     count;
        xfs_acl_t               *acl;
@@ -940,10 +940,22 @@ xfs_acl_from_disk(xfs_acl_disk_t *dacl)
        xfs_acl_entry_disk_t    *dace, *end;
 
        count = be32_to_cpu(dacl->acl_cnt);
+       if (count > XFS_ACL_MAX_ENTRIES) {
+               do_warn(_("to larget ACL, size %d"), count);
+               *aclp = NULL;
+               return EINVAL;
+       }
+
+
        end = &dacl->acl_entry[0] + count;
        acl = malloc((int)((char *)end - (char *)dacl));
-       if (!acl)
-               return NULL;
+       if (!acl) {
+               do_warn(_("cannot malloc enough for ACL attribute\n"));
+               do_warn(_("SKIPPING this ACL\n"));
+               *aclp = NULL;
+               return ENOMEM;
+       }
+
        acl->acl_cnt = count;
        ace = &acl->acl_entry[0];
        for (dace = &dacl->acl_entry[0]; dace < end; ace++, dace++) {
@@ -951,7 +963,9 @@ xfs_acl_from_disk(xfs_acl_disk_t *dacl)
                ace->ae_id = be32_to_cpu(dace->ae_id);
                ace->ae_perm = be16_to_cpu(dace->ae_perm);
        }
-       return acl;
+
+       *aclp = acl;
+       return 0;
 }
 
 /*
@@ -1004,15 +1018,14 @@ xfs_acl_valid(xfs_acl_disk_t *daclp)
        if (daclp == NULL)
                goto acl_invalid;
 
-       aclp = xfs_acl_from_disk(daclp);
-       if (aclp == NULL) {
-               do_warn(_("cannot malloc enough for ACL attribute\n"));
-               do_warn(_("SKIPPING this ACL\n"));
+       switch (xfs_acl_from_disk(&aclp, daclp)) {
+       case ENOMEM:
                return 0;
-       }
-
-       if (aclp->acl_cnt > XFS_ACL_MAX_ENTRIES)
+       case EINVAL:
                goto acl_invalid;
+       default:
+               break;
+       }
 
        for (i = 0; i < aclp->acl_cnt; i++) {
                entry = &aclp->acl_entry[i];

<Prev in Thread] Current Thread [Next in Thread>