[Top] [All Lists]

[patch] xfs: check for underflow in xfs_iformat_fork()

To: Ben Myers <bpm@xxxxxxx>
Subject: [patch] xfs: check for underflow in xfs_iformat_fork()
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Thu, 15 Aug 2013 08:53:38 +0300
Cc: Alex Elder <elder@xxxxxxxxxx>, xfs@xxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, kernel-janitors@xxxxxxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
User-agent: Mutt/1.5.21 (2010-09-15)
The "di_size" variable comes from the disk and it's a signed 64 bit.
We check the upper limit but we should check for negative numbers as

Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

diff --git a/fs/xfs/xfs_inode_fork.c b/fs/xfs/xfs_inode_fork.c
index 123971b..849fc70 100644
--- a/fs/xfs/xfs_inode_fork.c
+++ b/fs/xfs/xfs_inode_fork.c
@@ -167,7 +167,8 @@ xfs_iformat_fork(
                        di_size = be64_to_cpu(dip->di_size);
-                       if (unlikely(di_size > XFS_DFORK_DSIZE(dip, 
ip->i_mount))) {
+                       if (unlikely(di_size < 0 ||
+                                    di_size > XFS_DFORK_DSIZE(dip, 
ip->i_mount))) {
                        "corrupt inode %Lu (bad size %Ld for local inode).",
                                        (unsigned long long) ip->i_ino,

<Prev in Thread] Current Thread [Next in Thread>