Skip to content

Commit fb63435

Browse files
LLfamChandan Babu R
authored andcommitted
xfs: add bounds checking to xlog_recover_process_data
There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header. Signed-off-by: lei lu <[email protected]> Reviewed-by: Dave Chinner <[email protected]> Reviewed-by: Darrick J. Wong <[email protected]> Signed-off-by: Chandan Babu R <[email protected]>
1 parent f23660f commit fb63435

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

fs/xfs/xfs_log_recover.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2489,7 +2489,10 @@ xlog_recover_process_data(
24892489

24902490
ohead = (struct xlog_op_header *)dp;
24912491
dp += sizeof(*ohead);
2492-
ASSERT(dp <= end);
2492+
if (dp > end) {
2493+
xfs_warn(log->l_mp, "%s: op header overrun", __func__);
2494+
return -EFSCORRUPTED;
2495+
}
24932496

24942497
/* errors will abort recovery */
24952498
error = xlog_recover_process_ophdr(log, rhash, rhead, ohead,

0 commit comments

Comments
 (0)