From 02b56f8733c7e8e86bc459c05e5832ec597cd5ad Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Wed, 25 Jan 2017 20:02:43 -0600 Subject: [PATCH] xfs_repair: strengthen geometry checks In xfs_repair, the inodelog, sectlog, and dirblklog values are read directly into the xfs_mount structure without any sanity checking by the verifier. This results in xfs_repair segfaulting when those fields have ridiculously high values because the pointer arithmetic runs us off the end of the metadata buffers. Therefore, reject the superblock if these values are garbage and try to find one of the other ones. Clean up the dblocks checking to use the relevant macros. The superblock field fuzzer (xfs/1301) triggers all these segfaults. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen Signed-off-by: Eric Sandeen --- repair/globals.h | 3 ++- repair/sb.c | 27 +++++++++++++++++---------- repair/xfs_repair.c | 2 ++ 3 files changed, 21 insertions(+), 11 deletions(-) diff --git a/repair/globals.h b/repair/globals.h index efd1d03b2..4085ccc43 100644 --- a/repair/globals.h +++ b/repair/globals.h @@ -50,7 +50,8 @@ #define XR_BAD_SB_WIDTH 18 /* bad stripe width */ #define XR_BAD_SVN 19 /* bad shared version number */ #define XR_BAD_CRC 20 /* Bad CRC */ -#define XR_BAD_ERR_CODE 21 /* Bad error code */ +#define XR_BAD_DIR_SIZE_DATA 21 /* Bad directory geometry */ +#define XR_BAD_ERR_CODE 22 /* Bad error code */ /* XFS filesystem (il)legal values */ diff --git a/repair/sb.c b/repair/sb.c index 004702c52..77e51546f 100644 --- a/repair/sb.c +++ b/repair/sb.c @@ -395,20 +395,22 @@ verify_sb(char *sb_buf, xfs_sb_t *sb, int is_primary_sb) /* sanity check ag count, size fields against data size field */ if (sb->sb_dblocks == 0 || - sb->sb_dblocks > - ((__uint64_t)sb->sb_agcount * sb->sb_agblocks) || - sb->sb_dblocks < - ((__uint64_t)(sb->sb_agcount - 1) * sb->sb_agblocks - + XFS_MIN_AG_BLOCKS)) + sb->sb_dblocks > XFS_MAX_DBLOCKS(sb) || + sb->sb_dblocks < XFS_MIN_DBLOCKS(sb)) return(XR_BAD_FS_SIZE_DATA); if (sb->sb_agblklog != (__uint8_t)libxfs_log2_roundup(sb->sb_agblocks)) return(XR_BAD_FS_SIZE_DATA); - if (sb->sb_inodesize < XFS_DINODE_MIN_SIZE || - sb->sb_inodesize > XFS_DINODE_MAX_SIZE || - sb->sb_inopblock != howmany(sb->sb_blocksize,sb->sb_inodesize)) - return(XR_BAD_INO_SIZE_DATA); + if (sb->sb_inodesize < XFS_DINODE_MIN_SIZE || + sb->sb_inodesize > XFS_DINODE_MAX_SIZE || + sb->sb_inodelog < XFS_DINODE_MIN_LOG || + sb->sb_inodelog > XFS_DINODE_MAX_LOG || + sb->sb_inodesize != (1 << sb->sb_inodelog) || + sb->sb_logsunit > XLOG_MAX_RECORD_BSIZE || + sb->sb_inopblock != howmany(sb->sb_blocksize, sb->sb_inodesize) || + (sb->sb_blocklog - sb->sb_inodelog != sb->sb_inopblog)) + return XR_BAD_INO_SIZE_DATA; if (xfs_sb_version_hassector(sb)) { @@ -492,7 +494,12 @@ verify_sb(char *sb_buf, xfs_sb_t *sb, int is_primary_sb) if ((sb->sb_unit && !sb->sb_width) || (sb->sb_width && sb->sb_unit && sb->sb_width % sb->sb_unit)) return(XR_BAD_SB_WIDTH); - } + } else if (sb->sb_unit || sb->sb_width) + return XR_BAD_SB_WIDTH; + + /* Directory block log */ + if (sb->sb_blocklog + sb->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG) + return XR_BAD_DIR_SIZE_DATA; return(XR_OK); } diff --git a/repair/xfs_repair.c b/repair/xfs_repair.c index 5c79fd95e..b07567bfc 100644 --- a/repair/xfs_repair.c +++ b/repair/xfs_repair.c @@ -143,6 +143,8 @@ err_string(int err_code) _("bad shared version number in superblock"); err_message[XR_BAD_CRC] = _("bad CRC in superblock"); + err_message[XR_BAD_DIR_SIZE_DATA] = + _("inconsistent directory geometry information"); done = 1; } -- 2.47.2