xfs: detect overflows in bmbt records

Source kernel commit: acf104c2331c1ba2a667e65dd36139d1555b1432

Detect file block mappings with a blockcount that's either so large that
integer overflows occur or are zero, because neither are valid in the
filesystem.  Worse yet, attempting directory modifications causes the
iext code to trip over the bmbt key handling and takes the filesystem
down.  We can fix most of this by preventing the bad metadata from
entering the incore structures in the first place.

Found by setting blockcount=0 in a directory data fork mapping and
watching the fireworks.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/libxfs/xfs_bmap.c b/libxfs/xfs_bmap.c
index e0ca8b050c46853063c8da523e224148df29f004..65cffb7b7d78fa1e0ba1a40553c59bf48e271182 100644 (file)
--- a/libxfs/xfs_bmap.c
+++ b/libxfs/xfs_bmap.c
@@ -6222,6 +6222,11 @@ xfs_bmap_validate_extent(
        xfs_fsblock_t           endfsb;
        bool                    isrt;
 
+       if (irec->br_startblock + irec->br_blockcount <= irec->br_startblock)
+               return __this_address;
+       if (irec->br_startoff + irec->br_blockcount <= irec->br_startoff)
+               return __this_address;
+
        isrt = XFS_IS_REALTIME_INODE(ip);
        endfsb = irec->br_startblock + irec->br_blockcount - 1;
        if (isrt && whichfork == XFS_DATA_FORK) {