]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfs_repair: fix infinite loop in longform_dir2_entry_check*
authorDarrick J. Wong <djwong@kernel.org>
Fri, 21 Mar 2025 16:32:02 +0000 (09:32 -0700)
committerAndrey Albershteyn <aalbersh@kernel.org>
Mon, 31 Mar 2025 09:45:45 +0000 (11:45 +0200)
commitbbd8ba73e64b43b29e96b813173aafd6da4ab1fc
tree6b02cda5e349270674f1febc14deb81916f62bdf
parentb26d16875213a6a25cc9194d45e4547a42ded5e1
xfs_repair: fix infinite loop in longform_dir2_entry_check*

If someone corrupts the data fork of a directory to have a bmap record
whose br_startoff only has bits set in the upper 32 bits, the code will
suffer an integer overflow when assigning the 64-bit next_da_bno to the
32-bit da_bno.  This leads to an infinite loop.

Found by fuzzing xfs/812 with u3.bmx[0].startoff = firstbit.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
libxfs/libxfs_api_defs.h
repair/phase6.c