xfs: validate explicit directory data buffer owners

Source kernel commit: cc6740ddb423db2066f7669eaaa377fdbf84ab1e

Port the existing directory data header checking function to accept an
owner number instead of an xfs_inode, then update the callsites to use
xfs_da_args.owner when possible.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/db/namei.c b/db/namei.c
index 5a6fd2036a374e712943b90ddfa36a04756c4392..d2541b78ae33735dcab799a098b1e5f3e261fdf3 100644 (file)
--- a/db/namei.c
+++ b/db/namei.c
@@ -398,7 +398,8 @@ list_leafdir(
                libxfs_trim_extent(&map, dabno, geo->leafblk - dabno);
 
                /* Read the directory block of that first mapping. */
-               error = xfs_dir3_data_read(NULL, dp, map.br_startoff, 0, &bp);
+               error = xfs_dir3_data_read(NULL, dp, args->owner,
+                               map.br_startoff, 0, &bp);
                if (error)
                        break;
 

diff --git a/libxfs/xfs_dir2.h b/libxfs/xfs_dir2.h
index 2f728c26a4162493ee90004afe66f47a23919f9b..d623bfdcd421850600e38c1dfc7e68a82670e8d8 100644 (file)
--- a/libxfs/xfs_dir2.h
+++ b/libxfs/xfs_dir2.h
@@ -102,6 +102,7 @@ extern struct xfs_dir2_data_free *xfs_dir2_data_freefind(
 extern int xfs_dir_ino_validate(struct xfs_mount *mp, xfs_ino_t ino);
 
 xfs_failaddr_t xfs_dir3_leaf_header_check(struct xfs_buf *bp, xfs_ino_t owner);
+xfs_failaddr_t xfs_dir3_data_header_check(struct xfs_buf *bp, xfs_ino_t owner);
 
 extern const struct xfs_buf_ops xfs_dir3_block_buf_ops;
 extern const struct xfs_buf_ops xfs_dir3_leafn_buf_ops;

diff --git a/libxfs/xfs_dir2_block.c b/libxfs/xfs_dir2_block.c
index c91559e59a942c15df306c857c63efb6a7d4192d..6107e01cafc7fb943bc33b0981409c80e781cfe1 100644 (file)
--- a/libxfs/xfs_dir2_block.c
+++ b/libxfs/xfs_dir2_block.c
@@ -979,7 +979,8 @@ xfs_dir2_leaf_to_block(
         * Read the data block if we don't already have it, give up if it fails.
         */
        if (!dbp) {
-               error = xfs_dir3_data_read(tp, dp, args->geo->datablk, 0, &dbp);
+               error = xfs_dir3_data_read(tp, dp, args->owner,
+                               args->geo->datablk, 0, &dbp);
                if (error)
                        return error;
        }

diff --git a/libxfs/xfs_dir2_data.c b/libxfs/xfs_dir2_data.c
index 6f3ccfeb69f7458e23c5c5ba6bba06df1cd302f7..0c77245eec82afeab915c169fe27fa08d9c2a927 100644 (file)
--- a/libxfs/xfs_dir2_data.c
+++ b/libxfs/xfs_dir2_data.c
@@ -392,17 +392,20 @@ static const struct xfs_buf_ops xfs_dir3_data_reada_buf_ops = {
        .verify_write = xfs_dir3_data_write_verify,
 };
 
-static xfs_failaddr_t
+xfs_failaddr_t
 xfs_dir3_data_header_check(
-       struct xfs_inode        *dp,
-       struct xfs_buf          *bp)
+       struct xfs_buf          *bp,
+       xfs_ino_t               owner)
 {
-       struct xfs_mount        *mp = dp->i_mount;
+       struct xfs_mount        *mp = bp->b_mount;
 
        if (xfs_has_crc(mp)) {
                struct xfs_dir3_data_hdr *hdr3 = bp->b_addr;
 
-               if (be64_to_cpu(hdr3->hdr.owner) != dp->i_ino)
+               if (hdr3->hdr.magic != cpu_to_be32(XFS_DIR3_DATA_MAGIC))
+                       return __this_address;
+
+               if (be64_to_cpu(hdr3->hdr.owner) != owner)
                        return __this_address;
        }
 
@@ -413,6 +416,7 @@ int
 xfs_dir3_data_read(
        struct xfs_trans        *tp,
        struct xfs_inode        *dp,
+       xfs_ino_t               owner,
        xfs_dablk_t             bno,
        unsigned int            flags,
        struct xfs_buf          **bpp)
@@ -426,7 +430,7 @@ xfs_dir3_data_read(
                return err;
 
        /* Check things that we can't do in the verifier. */
-       fa = xfs_dir3_data_header_check(dp, *bpp);
+       fa = xfs_dir3_data_header_check(*bpp, owner);
        if (fa) {
                __xfs_buf_mark_corrupt(*bpp, fa);
                xfs_trans_brelse(tp, *bpp);

diff --git a/libxfs/xfs_dir2_leaf.c b/libxfs/xfs_dir2_leaf.c
index 6ce2d4b28c6fe1141a28d04af110b23eaae9f236..1c12b5a6644dfea0adf989b6bf91606f9634b362 100644 (file)
--- a/libxfs/xfs_dir2_leaf.c
+++ b/libxfs/xfs_dir2_leaf.c
@@ -883,9 +883,9 @@ xfs_dir2_leaf_addname(
                 * Already had space in some data block.
                 * Just read that one in.
                 */
-               error = xfs_dir3_data_read(tp, dp,
-                                  xfs_dir2_db_to_da(args->geo, use_block),
-                                  0, &dbp);
+               error = xfs_dir3_data_read(tp, dp, args->owner,
+                               xfs_dir2_db_to_da(args->geo, use_block), 0,
+                               &dbp);
                if (error) {
                        xfs_trans_brelse(tp, lbp);
                        return error;
@@ -1326,9 +1326,9 @@ xfs_dir2_leaf_lookup_int(
                if (newdb != curdb) {
                        if (dbp)
                                xfs_trans_brelse(tp, dbp);
-                       error = xfs_dir3_data_read(tp, dp,
-                                          xfs_dir2_db_to_da(args->geo, newdb),
-                                          0, &dbp);
+                       error = xfs_dir3_data_read(tp, dp, args->owner,
+                                       xfs_dir2_db_to_da(args->geo, newdb), 0,
+                                       &dbp);
                        if (error) {
                                xfs_trans_brelse(tp, lbp);
                                return error;
@@ -1368,9 +1368,9 @@ xfs_dir2_leaf_lookup_int(
                ASSERT(cidb != -1);
                if (cidb != curdb) {
                        xfs_trans_brelse(tp, dbp);
-                       error = xfs_dir3_data_read(tp, dp,
-                                          xfs_dir2_db_to_da(args->geo, cidb),
-                                          0, &dbp);
+                       error = xfs_dir3_data_read(tp, dp, args->owner,
+                                       xfs_dir2_db_to_da(args->geo, cidb), 0,
+                                       &dbp);
                        if (error) {
                                xfs_trans_brelse(tp, lbp);
                                return error;
@@ -1664,7 +1664,8 @@ xfs_dir2_leaf_trim_data(
        /*
         * Read the offending data block.  We need its buffer.
         */
-       error = xfs_dir3_data_read(tp, dp, xfs_dir2_db_to_da(geo, db), 0, &dbp);
+       error = xfs_dir3_data_read(tp, dp, args->owner,
+                       xfs_dir2_db_to_da(geo, db), 0, &dbp);
        if (error)
                return error;
 

diff --git a/libxfs/xfs_dir2_node.c b/libxfs/xfs_dir2_node.c
index c0160d725e54293d167b83f2b66203f797f5a783..690407374187ff0ddc7b9ad29e96f063ee90f6d5 100644 (file)
--- a/libxfs/xfs_dir2_node.c
+++ b/libxfs/xfs_dir2_node.c
@@ -860,7 +860,7 @@ xfs_dir2_leafn_lookup_for_entry(
                                ASSERT(state->extravalid);
                                curbp = state->extrablk.bp;
                        } else {
-                               error = xfs_dir3_data_read(tp, dp,
+                               error = xfs_dir3_data_read(tp, dp, args->owner,
                                                xfs_dir2_db_to_da(args->geo,
                                                                  newdb),
                                                0, &curbp);
@@ -1946,9 +1946,8 @@ xfs_dir2_node_addname_int(
                                                  &freehdr, &findex);
        } else {
                /* Read the data block in. */
-               error = xfs_dir3_data_read(tp, dp,
-                                          xfs_dir2_db_to_da(args->geo, dbno),
-                                          0, &dbp);
+               error = xfs_dir3_data_read(tp, dp, args->owner,
+                               xfs_dir2_db_to_da(args->geo, dbno), 0, &dbp);
        }
        if (error)
                return error;

diff --git a/libxfs/xfs_dir2_priv.h b/libxfs/xfs_dir2_priv.h
index 2f0e3ad47b3713e825db6a6dc61151652f25f2d2..879aa2e9fd73041e13f7c41e513529fa882e4c83 100644 (file)
--- a/libxfs/xfs_dir2_priv.h
+++ b/libxfs/xfs_dir2_priv.h
@@ -78,7 +78,8 @@ extern void xfs_dir3_data_check(struct xfs_inode *dp, struct xfs_buf *bp);
 extern xfs_failaddr_t __xfs_dir3_data_check(struct xfs_inode *dp,
                struct xfs_buf *bp);
 int xfs_dir3_data_read(struct xfs_trans *tp, struct xfs_inode *dp,
-               xfs_dablk_t bno, unsigned int flags, struct xfs_buf **bpp);
+               xfs_ino_t owner, xfs_dablk_t bno, unsigned int flags,
+               struct xfs_buf **bpp);
 int xfs_dir3_data_readahead(struct xfs_inode *dp, xfs_dablk_t bno,
                unsigned int flags);