From 629d6b3df786a8a241b2cd72fb5885d66ea143d8 Mon Sep 17 00:00:00 2001 From: Dave Chinner Date: Thu, 15 Jun 2023 18:37:35 -0700 Subject: [PATCH] xfs: validity check agbnos on the AGFL Source kernel commit: 3148ebf2c0782340946732bfaf3073d23ac833fa If the agfl or the indexing in the AGF has been corrupted, getting a block form the AGFL could return an invalid block number. If this happens, bad things happen. Check the agbno we pull off the AGFL and return -EFSCORRUPTED if we find somethign bad. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino --- libxfs/xfs_alloc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libxfs/xfs_alloc.c b/libxfs/xfs_alloc.c index 229b22e65..40a36efa7 100644 --- a/libxfs/xfs_alloc.c +++ b/libxfs/xfs_alloc.c @@ -2776,6 +2776,9 @@ xfs_alloc_get_freelist( */ agfl_bno = xfs_buf_to_agfl_bno(agflbp); bno = be32_to_cpu(agfl_bno[be32_to_cpu(agf->agf_flfirst)]); + if (XFS_IS_CORRUPT(tp->t_mountp, !xfs_verify_agbno(pag, bno))) + return -EFSCORRUPTED; + be32_add_cpu(&agf->agf_flfirst, 1); xfs_trans_brelse(tp, agflbp); if (be32_to_cpu(agf->agf_flfirst) == xfs_agfl_size(mp)) -- 2.47.2