diff options
| author | Eric Sandeen <sandeen@redhat.com> | 2014-11-28 14:03:55 +1100 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2014-11-28 14:03:55 +1100 |
| commit | db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6 (patch) | |
| tree | 7c7ede18b9f3531f1831019a79e9c6dfa6edc83e /fs/xfs/xfs_buf.c | |
| parent | 91ee575f2b35d1307412f917787195c2f6a38dfb (diff) | |
| download | linux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.tar.gz linux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.tar.bz2 linux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.zip | |
xfs: catch invalid negative blknos in _xfs_buf_find()
Here blkno is a daddr_t, which is a __s64; it's possible to hold
a value which is negative, and thus pass the (blkno >= eofs)
test. Then we try to do a xfs_perag_get() for a ridiculous
agno via xfs_daddr_to_agno(), and bad things happen when that
fails, and returns a null pag which is dereferenced shortly
thereafter.
Found via a user-supplied fuzzed image...
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_buf.c')
| -rw-r--r-- | fs/xfs/xfs_buf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c index c06d790a3000..d083889535a2 100644 --- a/fs/xfs/xfs_buf.c +++ b/fs/xfs/xfs_buf.c @@ -461,7 +461,7 @@ _xfs_buf_find( * have to check that the buffer falls within the filesystem bounds. */ eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks); - if (blkno >= eofs) { + if (blkno < 0 || blkno >= eofs) { /* * XXX (dgc): we should really be returning -EFSCORRUPTED here, * but none of the higher level infrastructure supports |