summaryrefslogtreecommitdiffstats
path: root/fs/xfs/xfs_buf.c
diff options
context:
space:
mode:
authorEric Sandeen <sandeen@redhat.com>2014-11-28 14:03:55 +1100
committerDave Chinner <david@fromorbit.com>2014-11-28 14:03:55 +1100
commitdb52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6 (patch)
tree7c7ede18b9f3531f1831019a79e9c6dfa6edc83e /fs/xfs/xfs_buf.c
parent91ee575f2b35d1307412f917787195c2f6a38dfb (diff)
downloadlinux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.tar.gz
linux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.tar.bz2
linux-stable-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.zip
xfs: catch invalid negative blknos in _xfs_buf_find()
Here blkno is a daddr_t, which is a __s64; it's possible to hold a value which is negative, and thus pass the (blkno >= eofs) test. Then we try to do a xfs_perag_get() for a ridiculous agno via xfs_daddr_to_agno(), and bad things happen when that fails, and returns a null pag which is dereferenced shortly thereafter. Found via a user-supplied fuzzed image... Signed-off-by: Eric Sandeen <sandeen@redhat.com> Reviewed-by: Mark Tinguely <tinguely@sgi.com> Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_buf.c')
-rw-r--r--fs/xfs/xfs_buf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index c06d790a3000..d083889535a2 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -461,7 +461,7 @@ _xfs_buf_find(
* have to check that the buffer falls within the filesystem bounds.
*/
eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks);
- if (blkno >= eofs) {
+ if (blkno < 0 || blkno >= eofs) {
/*
* XXX (dgc): we should really be returning -EFSCORRUPTED here,
* but none of the higher level infrastructure supports