]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfs: fix maxicount division by zero error
authorDarrick J. Wong <darrick.wong@oracle.com>
Fri, 13 Dec 2019 00:54:33 +0000 (19:54 -0500)
committerEric Sandeen <sandeen@redhat.com>
Fri, 13 Dec 2019 00:54:33 +0000 (19:54 -0500)
commit781732798f9299253fc067bf0843516f87642726
tree7b2bb983156921a10448dcdaae9db604feb5c703
parent763d7f0718bc491566d27db1cd29ea789b133f60
xfs: fix maxicount division by zero error

Source kernel commit: c94613feefd7714ad0d03a1914632c15782114ff

In xfs_ialloc_setup_geometry, it's possible for a malicious/corrupt fs
image to set an unreasonably large value for sb_inopblog which will
cause ialloc_blks to be zero.  If sb_imax_pct is also set, this results
in a division by zero error in the second do_div call.  Therefore, force
maxicount to zero if ialloc_blks is zero.

Note that the kernel metadata verifiers will catch the garbage inopblog
value and abort the fs mount long before it tries to set up the inode
geometry; this is needed to avoid a crash in xfs_db while setting up the
xfs_mount structure.

Found by fuzzing sb_inopblog to 122 in xfs/350.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
libxfs/xfs_ialloc.c