[PATCH] xfs: catch invalid negative blknos in _xfs_buf_find()

Mark Tinguely tinguely at sgi.com
Wed Nov 26 10:38:05 CST 2014


On 11/19/14 16:12, Eric Sandeen wrote:
> Here blkno is a daddr_t, which is a __s64; it's possible to hold
> a value which is negative, and thus pass the (blkno>= eofs)
> test.  Then we try to do a xfs_perag_get() for a ridiculous
> agno via xfs_daddr_to_agno(), and bad things happen when that
> fails, and returns a null pag which is dereferenced shortly
> thereafter.
>
> Found via a user-supplied fuzzed image...
>
> Signed-off-by: Eric Sandeen<sandeen at redhat.com>
> ---

Looks good.

I did a little playing with sending the try lock failure (EAGAIN?) and 
EFSCORRUPT error status up the stack. It looked straight forward and 
could save a xfs_buf allocation when we know it is not necessary.

Reviewed-by: Mark Tinguely <tinguely at sgi.com>



More information about the xfs mailing list