diff options
| author | Eric Sandeen <sandeen@redhat.com> | 2014-11-28 04:03:55 +0100 |
|---|---|---|
| committer | Dave Chinner <david@fromorbit.com> | 2014-11-28 04:03:55 +0100 |
| commit | db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6 (patch) | |
| tree | 7c7ede18b9f3531f1831019a79e9c6dfa6edc83e /fs/xfs/xfs_iomap.c | |
| parent | xfs: allow lazy sb counter sync during filesystem freeze sequence (diff) | |
| download | linux-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.tar.xz linux-db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6.zip | |
xfs: catch invalid negative blknos in _xfs_buf_find()
Here blkno is a daddr_t, which is a __s64; it's possible to hold
a value which is negative, and thus pass the (blkno >= eofs)
test. Then we try to do a xfs_perag_get() for a ridiculous
agno via xfs_daddr_to_agno(), and bad things happen when that
fails, and returns a null pag which is dereferenced shortly
thereafter.
Found via a user-supplied fuzzed image...
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_iomap.c')
0 files changed, 0 insertions, 0 deletions