]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
libxfs: sanitize sb_inopblock in xfs_mount_validate_sb
authorDave Chinner <dchinner@redhat.com>
Thu, 6 Mar 2014 23:24:44 +0000 (10:24 +1100)
committerDave Chinner <david@fromorbit.com>
Thu, 6 Mar 2014 23:24:44 +0000 (10:24 +1100)
commit4b0c789dccb51ede019335389d8a9923cbfb7b71
treebc4145310c7a9deceef005dfc32184442b598c8d
parent46ea3a62bcbedcea2d30eda8fb4ac435e96fd8db
libxfs: sanitize sb_inopblock in xfs_mount_validate_sb

[userspace port]

xfs_mount_validate_sb doesn't check sb_inopblock for sanity
(as does its xfs_repair counterpart, FWIW).

If it's out of bounds, we can go off the rails in i.e.
xfs_inode_buf_verify(), which uses sb_inopblock as a loop
limit when stepping through a metadata buffer.

The problem can be demonstrated easily by corrupting
sb_inopblock with xfs_db and trying to mount the result:

# mkfs.xfs -dfile,name=fsfile,size=1g
# xfs_db -x fsfile
xfs_db> sb 0
xfs_db> write inopblock 512
inopblock = 512
xfs_db> quit

# mount -o loop fsfile  mnt
and we blow up in xfs_inode_buf_verify().

With this patch, we get a (very noisy) corruption error,
and fail the mount as we should.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
libxfs/xfs_sb.c