From: Darrick J. Wong Date: Thu, 28 Jun 2018 20:11:57 +0000 (-0500) Subject: xfs: strengthen rtalloc query range checks X-Git-Tag: v4.18.0-rc0~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dc1e0902657dbcaf86b379cf59f5583c11070046;p=thirdparty%2Fxfsprogs-dev.git xfs: strengthen rtalloc query range checks Source kernel commit: 8ad560d2565e64b8be0cf5901c1e8fe034ac5599 Strengthen the rtalloc range query checks to make sure that the keys do not run off the end of the realtime device inappropriately. Note that the query range functions require units of rt extents, not blocks, despite the type name. Signed-off-by: Darrick J. Wong Reviewed-by: Allison Henderson Reviewed-by: Bill O'Donnell Signed-off-by: Eric Sandeen --- diff --git a/libxfs/xfs_rtbitmap.c b/libxfs/xfs_rtbitmap.c index 652eb4f69..c97ccc68a 100644 --- a/libxfs/xfs_rtbitmap.c +++ b/libxfs/xfs_rtbitmap.c @@ -1033,8 +1033,11 @@ xfs_rtalloc_query_range( if (low_rec->ar_startblock > high_rec->ar_startblock) return -EINVAL; - else if (low_rec->ar_startblock == high_rec->ar_startblock) + if (low_rec->ar_startblock >= mp->m_sb.sb_rextents || + low_rec->ar_startblock == high_rec->ar_startblock) return 0; + if (high_rec->ar_startblock >= mp->m_sb.sb_rextents) + high_rec->ar_startblock = mp->m_sb.sb_rextents - 1; /* Iterate the bitmap, looking for discrepancies. */ rtstart = low_rec->ar_startblock; @@ -1078,7 +1081,7 @@ xfs_rtalloc_query_all( struct xfs_rtalloc_rec keys[2]; keys[0].ar_startblock = 0; - keys[1].ar_startblock = tp->t_mountp->m_sb.sb_rblocks; + keys[1].ar_startblock = tp->t_mountp->m_sb.sb_rextents - 1; keys[0].ar_blockcount = keys[1].ar_blockcount = 0; return xfs_rtalloc_query_range(tp, &keys[0], &keys[1], fn, priv);