]> git.baikalelectronics.ru Git - kernel.git/commit
xfs: avoid LR buffer overrun due to crafted h_len
authorGao Xiang <hsiangkao@redhat.com>
Tue, 22 Sep 2020 16:41:06 +0000 (09:41 -0700)
committerDarrick J. Wong <darrick.wong@oracle.com>
Wed, 23 Sep 2020 15:58:52 +0000 (08:58 -0700)
commit2120d05cd3cd11ad410e8249f91dbdd86c19c033
tree90190165b7b714a83a53fdf69f3fc2c976850c7c
parent1caf27da3cff9f59ed64cfb4339ea9f9996133dc
xfs: avoid LR buffer overrun due to crafted h_len

Currently, crafted h_len has been blocked for the log
header of the tail block in commit 4fcd42c9495d ("xfs:
detect and handle invalid iclog size set by mkfs").

However, each log record could still have crafted h_len
and cause log record buffer overrun. So let's check
h_len vs buffer size for each log record as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
fs/xfs/xfs_log_recover.c