Commit ff392c49 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Felix Blyakher

xfs: prevent kernel crash due to corrupted inode log format

Andras Korn reported an oops on log replay causes by a corrupted
xfs_inode_log_format_t passing a 0 size to kmem_zalloc.  This patch handles
to small or too large numbers of log regions gracefully by rejecting the
log replay with a useful error message.
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reported-by: default avatarAndras Korn <korn-sgi.com@chardonnay.math.bme.hu>
Reviewed-by: default avatarEric Sandeen <sandeen@sandeen.net>
Signed-off-by: default avatarFelix Blyakher <felixb@sgi.com>
parent 27e88bf6
...@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans( ...@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
item = item->ri_prev; item = item->ri_prev;
if (item->ri_total == 0) { /* first region to be added */ if (item->ri_total == 0) { /* first region to be added */
item->ri_total = in_f->ilf_size; if (in_f->ilf_size == 0 ||
ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM); in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
item->ri_buf = kmem_zalloc((item->ri_total * xlog_warn(
sizeof(xfs_log_iovec_t)), KM_SLEEP); "XFS: bad number of regions (%d) in inode log format",
in_f->ilf_size);
ASSERT(0);
return XFS_ERROR(EIO);
}
item->ri_total = in_f->ilf_size;
item->ri_buf =
kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
KM_SLEEP);
} }
ASSERT(item->ri_total > item->ri_cnt); ASSERT(item->ri_total > item->ri_cnt);
/* Description region is ri_buf[0] */ /* Description region is ri_buf[0] */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment