From: Dave Chinner <david@fromorbit.com>
To: Zheng Bin <zhengbin13@huawei.com>
Cc: darrick.wong@oracle.com, sandeen@redhat.com,
linux-xfs@vger.kernel.org, renxudong1@huawei.com
Subject: Re: [PATCH] xfs: add agf freeblocks verify in xfs_agf_verify
Date: Fri, 14 Feb 2020 07:55:04 +1100 [thread overview]
Message-ID: <20200213205504.GU10776@dread.disaster.area> (raw)
In-Reply-To: <1581587639-130771-1-git-send-email-zhengbin13@huawei.com>
On Thu, Feb 13, 2020 at 05:53:59PM +0800, Zheng Bin wrote:
> We recently used fuzz(hydra) to test XFS and automatically generate
> tmp.img(XFS v5 format, but some metadata is wrong)
>
> Test as follows:
> mount tmp.img tmpdir
> cp file1M tmpdir
> sync
>
> tmpdir/file1M size is 1M, but its data can not sync to disk.
>
> This is because tmp.img has some problems, using xfs_repair detect
> information as follows:
>
> agf_freeblks 0, counted 3224 in ag 0
> agf_longest 536874136, counted 3224 in ag 0
> sb_fdblocks 613, counted 3228
>
> Add these agf freeblocks checks:
> 1. agf_longest < agf_freeblks
> 2. agf_freeblks < sb_fdblocks
Did you audit the other fields in the AGF to see if they were
adequately bounds checked by xfs_agf_verify()?
A quick look at struct xfs_agf and xfs_agf_verify() indicates that
agf_length, agf_rmap_blocks and agf_refcount_blocks are not bounds
checked, either. And agf_spare64 and agf_spare2 are not checked for
being zero....
Cheers,
Dave.
--
Dave Chinner
david@fromorbit.com
prev parent reply other threads:[~2020-02-13 20:55 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-13 9:53 [PATCH] xfs: add agf freeblocks verify in xfs_agf_verify Zheng Bin
2020-02-13 13:37 ` Eric Sandeen
2020-02-13 17:44 ` Darrick J. Wong
2020-02-13 20:55 ` Dave Chinner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200213205504.GU10776@dread.disaster.area \
--to=david@fromorbit.com \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
--cc=renxudong1@huawei.com \
--cc=sandeen@redhat.com \
--cc=zhengbin13@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).