diff options
| author | Darrick J. Wong <darrick.wong@oracle.com> | 2018-03-23 20:06:51 +0300 |
|---|---|---|
| committer | Darrick J. Wong <darrick.wong@oracle.com> | 2018-03-24 04:05:07 +0300 |
| commit | 6915ef35c0350e87a104cb4c4ab2121c81ca7a34 (patch) | |
| tree | b69db4b59599ceb73769e1c593326a9707ba9998 /fs/xfs/libxfs/xfs_dir2_leaf.c | |
| parent | a27ba2607e60312554cbcd43fc660b2c7f29dc9c (diff) | |
| download | linux-6915ef35c0350e87a104cb4c4ab2121c81ca7a34.tar.xz | |
xfs: sanity-check the unused space before trying to use it
In xfs_dir2_data_use_free, we examine on-disk metadata and ASSERT if
it doesn't make sense. Since a carefully crafted fuzzed image can cause
the kernel to crash after blowing a bunch of assertions, let's move
those checks into a validator function and rig everything up to return
EFSCORRUPTED to userspace. Found by lastbit fuzzing ltail.bestcount via
xfs/391.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Diffstat (limited to 'fs/xfs/libxfs/xfs_dir2_leaf.c')
| -rw-r--r-- | fs/xfs/libxfs/xfs_dir2_leaf.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c index d61d52da95a1..50fc9c0c5e2b 100644 --- a/fs/xfs/libxfs/xfs_dir2_leaf.c +++ b/fs/xfs/libxfs/xfs_dir2_leaf.c @@ -877,9 +877,13 @@ xfs_dir2_leaf_addname( /* * Mark the initial part of our freespace in use for the new entry. */ - xfs_dir2_data_use_free(args, dbp, dup, - (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr), length, - &needlog, &needscan); + error = xfs_dir2_data_use_free(args, dbp, dup, + (xfs_dir2_data_aoff_t)((char *)dup - (char *)hdr), + length, &needlog, &needscan); + if (error) { + xfs_trans_brelse(tp, lbp); + return error; + } /* * Initialize our new entry (at last). */ |