Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1572634

[PATCH 4.9 39/51] xfs: sanity check directory inode di_size

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Amir Goldstein <amir73il@gmail.com>

commit 3c6f46eacd876bd723a9bad3c6882714c052fd8e upstream.

This changes fixes an assertion hit when fuzzing on-disk
i_mode values.

The easy case to fix is when changing an empty file
i_mode to S_IFDIR. In this case, xfs_dinode_verify()
detects an illegal zero size for directory and fails
to load the inode structure from disk.

For the case of non empty file whose i_mode is changed
to S_IFDIR, the ASSERT() statement in xfs_dir2_isblock()
is replaced with return -EFSCORRUPTED, to avoid interacting
with corrupted jusk also when XFS_DEBUG is disabled.

Suggested-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_dir2.c      |    3 ++-
 fs/xfs/libxfs/xfs_inode_buf.c |    7 +++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

--- a/fs/xfs/libxfs/xfs_dir2.c
+++ b/fs/xfs/libxfs/xfs_dir2.c
@@ -631,7 +631,8 @@ xfs_dir2_isblock(
 	if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK)))
 		return rval;
 	rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize;
-	ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize);
+	if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize)
+		return -EFSCORRUPTED;
 	*vp = rval;
 	return 0;
 }
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -386,6 +386,7 @@ xfs_dinode_verify(
 	struct xfs_inode	*ip,
 	struct xfs_dinode	*dip)
 {
+	uint16_t		mode;
 	uint16_t		flags;
 	uint64_t		flags2;
 
@@ -396,8 +397,10 @@ xfs_dinode_verify(
 	if (be64_to_cpu(dip->di_size) & (1ULL << 63))
 		return false;
 
-	/* No zero-length symlinks. */
-	if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
+	mode = be16_to_cpu(dip->di_mode);
+
+	/* No zero-length symlinks/dirs. */
+	if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0)
 		return false;
 
 	/* only version 3 or greater inodes are extensively verified here */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 35/51] xfs: adjust allocation length in xfs_alloc_space_available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 36/51] xfs: dont rely on ->total in xfs_alloc_space_available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 09/51] tcp: fix tcp_fastopen unaligned access complaints on sparc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 05/51] mlxsw: pci: Fix EQE structure definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 04/51] mlxsw: switchx2: Fix memory leak at skb reallocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 03/51] mlxsw: spectrum: Fix memory leak at skb reallocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 26/51] net: mpls: Fix multipath selection for LSR use case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 11/51] mlx4: do not call napi_schedule() without care Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 14/51] ax25: Fix segfault after sock connection timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 47/51] xfs: verify dirblocklog correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 43/51] xfs: sanity check inode di_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 39/51] xfs: sanity check directory inode di_size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 15/51] net sched actions: fix refcnt when GETing of action after bind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 50/51] xfs: clear _XBF_PAGES from buffers when readahead page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 22/51] ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 31/51] lwtunnel: Fix oops on state free after encap module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 23/51] tcp: initialize max window for a new fastopen socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 49/51] xfs: extsize hints are not unlikely in xfs_bmap_btalloc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 24/51] net/mlx5e: Do not recycle pages from emergency reserve Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 08/51] net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 30/51] net: Specify the owning module for lwtunnel ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 20/51] net: phy: bcm63xx: Utilize correct config_intr function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 27/51] r8152: dont execute runtime suspend if the tx is not empty Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 46/51] xfs: fix COW writeback race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 44/51] xfs: dont wrap ID in xfs_dq_get_next_id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 06/51] net: lwtunnel: Handle lwtunnel_fill_encap failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 42/51] xfs: sanity check inode mode when creating new dentry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 32/51] net: dsa: Bring back device detaching in dsa_slave_suspend() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 41/51] xfs: replace xfs_mode_to_ftype table with switch statement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 10/51] openvswitch: maintain correct checksum state in conntrack actions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 13/51] ip6_tunnel: Account for tunnel header in tunnel MTU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 45/51] xfs: fix xfs_mode_to_ftype() prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 28/51] af_unix: move unix_mknod() out of bindlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 25/51] bridge: netlink: call br_changelink() during br_dev_newlink() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 34/51] xfs: fix bogus minleft manipulations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 37/51] xfs: dont print warnings when xfs_log_force fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 48/51] xfs: remove racy hasattr check from attr ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 12/51] ravb: do not use zero-length alignment DMA descriptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 51/51] xfs: fix bmv_count confusion w/ shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 33/51] xfs: bump up reserved blocks in xfs_alloc_set_aside Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 02/51] netvsc: add rcu_read locking to netvsc callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 17/51] virtio-net: restore VIRTIO_HDR_F_DATA_VALID on receiving Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 07/51] net: ipv4: fix table id in getroute response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 01/51] r8152: fix the sw rx checksum is unavailable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  Re: [PATCH 4.9 00/51] 4.9.8-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-02 21:40 +0100
    Re: [PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 22:00 +0100
  Re: [PATCH 4.9 00/51] 4.9.8-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-03 06:20 +0100
    Re: [PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-03 08:20 +0100

csiph-web