mdrestore: fix extent length overflow in v2 restore path

Aisle Research reported that a crafted metadump v2 extent
length can overflow the signed int used for length,
leading to incorrect size calculations and a
potential heap buffer over-read in restore_meta_extent().

Change the length type to uint64_t and ensure all size
arithmetic in 64-bit before converting to size_t for I/O
calls.

Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Manognya Singuru <msinguru@redhat.com>

diff --git a/mdrestore/xfs_mdrestore.c b/mdrestore/xfs_mdrestore.c
index ce7f596a6184feac4f7fb59eac0aafa31f662398..3df9d65ea6106ccd041fa196c901aecc79905151 100644 (file)
--- a/mdrestore/xfs_mdrestore.c
+++ b/mdrestore/xfs_mdrestore.c
@@ -395,11 +395,9 @@ restore_meta_extent(
        char            *device,
        void            *buf,
        uint64_t        offset,
-       int             len)
+       uint64_t        len)
 {
-       int             io_size;
-
-       io_size = min(len, MDR_IO_BUF_SIZE);
+       size_t io_size = min(len, MDR_IO_BUF_SIZE);
 
        do {
                if (fread(buf, io_size, 1, md_fp) != 1)
@@ -428,7 +426,7 @@ restore_v2(
        int64_t                 mb_read = 0;
        int64_t                 bytes_read;
        uint64_t                offset;
-       int                     len;
+       uint64_t                len;
 
        block_buffer = malloc(MDR_IO_BUF_SIZE);
        if (block_buffer == NULL)
@@ -445,7 +443,7 @@ restore_v2(
                fatal("Invalid superblock disk address 0x%llx\n",
                                be64_to_cpu(xme.xme_addr));
 
-       len = BBTOB(be32_to_cpu(xme.xme_len));
+       len = BBTOB((uint64_t)be32_to_cpu(xme.xme_len));
 
        /* The primary superblock is always a single filesystem sector. */
        if (len < BBTOB(1) || len > XFS_MAX_SECTORSIZE)
@@ -511,7 +509,7 @@ restore_v2(
                        break;
                }
 
-               len = BBTOB(be32_to_cpu(xme.xme_len));
+               len = BBTOB((uint64_t)be32_to_cpu(xme.xme_len));
 
                restore_meta_extent(md_fp, fd, device, block_buffer, offset,
                                len);