]> git.baikalelectronics.ru Git - kernel.git/commit
xfs: avoid LR buffer overrun due to crafted h_len
authorGao Xiang <hsiangkao@redhat.com>
Tue, 22 Sep 2020 16:41:06 +0000 (09:41 -0700)
committerDarrick J. Wong <darrick.wong@oracle.com>
Wed, 23 Sep 2020 15:58:52 +0000 (08:58 -0700)
commitf7008402d6228c6da3cb6816a0fab813f1cdc2c0
tree90190165b7b714a83a53fdf69f3fc2c976850c7c
parent5cf8c5bbf9f8077f8cb25934dde74744dfea951d
xfs: avoid LR buffer overrun due to crafted h_len

Currently, crafted h_len has been blocked for the log
header of the tail block in commit 81c0b4a528ba ("xfs:
detect and handle invalid iclog size set by mkfs").

However, each log record could still have crafted h_len
and cause log record buffer overrun. So let's check
h_len vs buffer size for each log record as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
fs/xfs/xfs_log_recover.c