diff options
| author | Dave Chinner <dchinner@redhat.com> | 2023-06-05 07:48:15 +0300 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2023-06-05 07:48:15 +0300 |
| commit | 3148ebf2c0782340946732bfaf3073d23ac833fa (patch) | |
| tree | 5ea13b64bc2c428a71729668b7a466bbcfc038dc /fs/xfs | |
| parent | e0a8de7da35e5b22b44fa1013ccc0716e17b0c14 (diff) | |
| download | linux-3148ebf2c0782340946732bfaf3073d23ac833fa.tar.xz | |
xfs: validity check agbnos on the AGFL
If the agfl or the indexing in the AGF has been corrupted, getting a
block form the AGFL could return an invalid block number. If this
happens, bad things happen. Check the agbno we pull off the AGFL
and return -EFSCORRUPTED if we find somethign bad.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs')
| -rw-r--r-- | fs/xfs/libxfs/xfs_alloc.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c index fd3293a8c659..643d17877832 100644 --- a/fs/xfs/libxfs/xfs_alloc.c +++ b/fs/xfs/libxfs/xfs_alloc.c @@ -2780,6 +2780,9 @@ xfs_alloc_get_freelist( */ agfl_bno = xfs_buf_to_agfl_bno(agflbp); bno = be32_to_cpu(agfl_bno[be32_to_cpu(agf->agf_flfirst)]); + if (XFS_IS_CORRUPT(tp->t_mountp, !xfs_verify_agbno(pag, bno))) + return -EFSCORRUPTED; + be32_add_cpu(&agf->agf_flfirst, 1); xfs_trans_brelse(tp, agflbp); if (be32_to_cpu(agf->agf_flfirst) == xfs_agfl_size(mp)) |