[PATCH] xfs: catch invalid negative blknos in _xfs_buf_find()
Mark Tinguely
tinguely at sgi.com
Wed Nov 26 10:38:05 CST 2014
On 11/19/14 16:12, Eric Sandeen wrote:
> Here blkno is a daddr_t, which is a __s64; it's possible to hold
> a value which is negative, and thus pass the (blkno>= eofs)
> test. Then we try to do a xfs_perag_get() for a ridiculous
> agno via xfs_daddr_to_agno(), and bad things happen when that
> fails, and returns a null pag which is dereferenced shortly
> thereafter.
>
> Found via a user-supplied fuzzed image...
>
> Signed-off-by: Eric Sandeen<sandeen at redhat.com>
> ---
Looks good.
I did a little playing with sending the try lock failure (EAGAIN?) and
EFSCORRUPT error status up the stack. It looked straight forward and
could save a xfs_buf allocation when we know it is not necessary.
Reviewed-by: Mark Tinguely <tinguely at sgi.com>
More information about the xfs
mailing list