From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DCF7C07E9D for ; Mon, 26 Sep 2022 10:51:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236681AbiIZKvV (ORCPT ); Mon, 26 Sep 2022 06:51:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236643AbiIZKsx (ORCPT ); Mon, 26 Sep 2022 06:48:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE4925789E; Mon, 26 Sep 2022 03:26:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 050EB60C13; Mon, 26 Sep 2022 10:26:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05A41C433D6; Mon, 26 Sep 2022 10:26:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664187979; bh=N3TddU4kN2v+JH26p5k5E5UOFYOaUiaRmR6KBiOEDBQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sltEAyPcIUr1a+dNt7GmT/8Y8KrZVFb87Oudcs9M7cdwxa16eokSFvz2ktfPNRz1s dAJZgifqKfomoguurUihrOfkCcuSW4ctZ9M/57nJTM3hz2aTE/VZR0xHNBEWM/V/3F ygHt7EQuWUvdMOGtBXbiD1NJ+iBuxQ0aMIsZ9MdA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Darrick J. Wong" , Christoph Hellwig , "Darrick J. Wong" , Chandan Babu R Subject: [PATCH 5.4 107/120] xfs: range check ri_cnt when recovering log items Date: Mon, 26 Sep 2022 12:12:20 +0200 Message-Id: <20220926100754.871725781@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220926100750.519221159@linuxfoundation.org> References: <20220926100750.519221159@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: "Darrick J. Wong" commit d6abecb82573fed5f7e4b595b5c0bd37707d2848 upstream. Range check the region counter when we're reassembling regions from log items during log recovery. In the old days ASSERT would halt the kernel, but this isn't true any more so we have to make an explicit error return. Coverity-id: 1132508 Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Acked-by: Darrick J. Wong Signed-off-by: Chandan Babu R Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_log_recover.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/fs/xfs/xfs_log_recover.c +++ b/fs/xfs/xfs_log_recover.c @@ -4293,7 +4293,16 @@ xlog_recover_add_to_trans( kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t), 0); } - ASSERT(item->ri_total > item->ri_cnt); + + if (item->ri_total <= item->ri_cnt) { + xfs_warn(log->l_mp, + "log item region count (%d) overflowed size (%d)", + item->ri_cnt, item->ri_total); + ASSERT(0); + kmem_free(ptr); + return -EFSCORRUPTED; + } + /* Description region is ri_buf[0] */ item->ri_buf[item->ri_cnt].i_addr = ptr; item->ri_buf[item->ri_cnt].i_len = len;