diff options
| author | Chandan Babu R <chandanbabu@kernel.org> | 2023-09-13 08:05:49 +0300 |
|---|---|---|
| committer | Chandan Babu R <chandanbabu@kernel.org> | 2023-09-13 08:05:49 +0300 |
| commit | 1155b12edbb5d79a5730e1d9348cf3d8b2107696 (patch) | |
| tree | 95a0c1ff8de6cecaf24c6c5eebd9f2bbd0456552 /fs/xfs | |
| parent | 6ebb6500e54631b7013f4efe7d78ff562e437c5e (diff) | |
| parent | e03192820002feb064cc4fd0df9b8f0a94675c7d (diff) | |
| download | linux-1155b12edbb5d79a5730e1d9348cf3d8b2107696.tar.xz | |
Merge tag 'fix-scrub-6.6_2023-09-12' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-6.6-fixesA
xfs: fix out of bounds memory access in scrub
This is a quick fix for a few internal syzbot reports concerning an
invalid memory access in the scrub code.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>
* tag 'fix-scrub-6.6_2023-09-12' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux:
xfs: only call xchk_stats_merge after validating scrub inputs
Diffstat (limited to 'fs/xfs')
| -rw-r--r-- | fs/xfs/scrub/scrub.c | 4 | ||||
| -rw-r--r-- | fs/xfs/scrub/stats.c | 5 |
2 files changed, 6 insertions, 3 deletions
diff --git a/fs/xfs/scrub/scrub.c b/fs/xfs/scrub/scrub.c index 7d3aa14d81b5..4849efcaa33a 100644 --- a/fs/xfs/scrub/scrub.c +++ b/fs/xfs/scrub/scrub.c @@ -588,6 +588,8 @@ out_nofix: out_teardown: error = xchk_teardown(sc, error); out_sc: + if (error != -ENOENT) + xchk_stats_merge(mp, sm, &run); kfree(sc); out: trace_xchk_done(XFS_I(file_inode(file)), sm, error); @@ -595,8 +597,6 @@ out: sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT; error = 0; } - if (error != -ENOENT) - xchk_stats_merge(mp, sm, &run); return error; need_drain: error = xchk_teardown(sc, 0); diff --git a/fs/xfs/scrub/stats.c b/fs/xfs/scrub/stats.c index aeb92624176b..cd91db4a5548 100644 --- a/fs/xfs/scrub/stats.c +++ b/fs/xfs/scrub/stats.c @@ -185,7 +185,10 @@ xchk_stats_merge_one( { struct xchk_scrub_stats *css; - ASSERT(sm->sm_type < XFS_SCRUB_TYPE_NR); + if (sm->sm_type >= XFS_SCRUB_TYPE_NR) { + ASSERT(sm->sm_type < XFS_SCRUB_TYPE_NR); + return; + } css = &cs->cs_stats[sm->sm_type]; spin_lock(&css->css_lock); |