xfs: range check ri_cnt when recovering log items (d6abecb8) · Commits · 戴 / test

Range check the region counter when we're reassembling regions from log items during log recovery. In the old days ASSERT would halt the kernel, but this isn't true any more so we have to make an explicit error return. Coverity-id: 1132508 Signed-off-by:

Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by:

Christoph Hellwig <hch@lst.de>

fs/xfs/xfs_log_recover.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -4301,7 +4301,16 @@ xlog_recover_add_to_trans(
		kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
		0);
		}
		ASSERT(item->ri_total > item->ri_cnt);

		if (item->ri_total <= item->ri_cnt) {
		xfs_warn(log->l_mp,
		"log item region count (%d) overflowed size (%d)",
		item->ri_cnt, item->ri_total);
		ASSERT(0);
		kmem_free(ptr);
		return -EFSCORRUPTED;
		}

		/* Description region is ri_buf[0] */
		item->ri_buf[item->ri_cnt].i_addr = ptr;
		item->ri_buf[item->ri_cnt].i_len = len;

Admin message