xfs: filter out obviously bad btree pointers

Source kernel commit: d5a91baeb6033c3392121e4d5c011cdc08dfa9f7

Don't let anybody load an obviously bad btree pointer.  Since the values
come from disk, we must return an error, not just ASSERT.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/libxfs/xfs_bmap.c b/libxfs/xfs_bmap.c
index 3e234ff2a0e08ed8d98ebf5c2af3f3b6f74d4522..8136d16e64e9ddf2cad2eff1237be5560ad0007c 100644 (file)
--- a/libxfs/xfs_bmap.c
+++ b/libxfs/xfs_bmap.c
@@ -1258,7 +1258,6 @@ xfs_bmap_read_extents(
        /* REFERENCED */
        xfs_extnum_t            room;   /* number of entries there's room for */
 
-       bno = NULLFSBLOCK;
        mp = ip->i_mount;
        ifp = XFS_IFORK_PTR(ip, whichfork);
        exntf = (whichfork != XFS_DATA_FORK) ? XFS_EXTFMT_NOSTATE :
@@ -1271,9 +1270,7 @@ xfs_bmap_read_extents(
        ASSERT(level > 0);
        pp = XFS_BMAP_BROOT_PTR_ADDR(mp, block, 1, ifp->if_broot_bytes);
        bno = be64_to_cpu(*pp);
-       ASSERT(bno != NULLFSBLOCK);
-       ASSERT(XFS_FSB_TO_AGNO(mp, bno) < mp->m_sb.sb_agcount);
-       ASSERT(XFS_FSB_TO_AGBNO(mp, bno) < mp->m_sb.sb_agblocks);
+
        /*
         * Go down the tree until leaf level is reached, following the first
         * pointer (leftmost) at each level.

diff --git a/libxfs/xfs_btree.c b/libxfs/xfs_btree.c
index 86ab8c605c3845d6b2cc323b1ac64f17fe94283d..1c024419ec63a55b25eacf9c2b6e7e3f685cbd72 100644 (file)
--- a/libxfs/xfs_btree.c
+++ b/libxfs/xfs_btree.c
@@ -822,7 +822,8 @@ xfs_btree_read_bufl(
        xfs_daddr_t             d;              /* real disk block address */
        int                     error;
 
-       ASSERT(fsbno != NULLFSBLOCK);
+       if (!XFS_FSB_SANITY_CHECK(mp, fsbno))
+               return -EFSCORRUPTED;
        d = XFS_FSB_TO_DADDR(mp, fsbno);
        error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp, d,
                                   mp->m_bsize, lock, &bp, ops);

diff --git a/libxfs/xfs_btree.h b/libxfs/xfs_btree.h
index 37f06983ae8c0699166f7791e719603665660f09..35ef62430012340edb41f2efeb3ffbb93ec53137 100644 (file)
--- a/libxfs/xfs_btree.h
+++ b/libxfs/xfs_btree.h
@@ -458,7 +458,7 @@ static inline int xfs_btree_get_level(struct xfs_btree_block *block)
 #define        XFS_FILBLKS_MAX(a,b)    max_t(xfs_filblks_t, (a), (b))
 
 #define        XFS_FSB_SANITY_CHECK(mp,fsb)    \
-       (XFS_FSB_TO_AGNO(mp, fsb) < mp->m_sb.sb_agcount && \
+       (fsb && XFS_FSB_TO_AGNO(mp, fsb) < mp->m_sb.sb_agcount && \
                XFS_FSB_TO_AGBNO(mp, fsb) < mp->m_sb.sb_agblocks)
 
 /*