xfs: range check ri_cnt when recovering log items

commit 0ca1fe8e270240fcd6810e73b4dc8cbf1afc14c1 upstream.

Range check the region counter when we're reassembling regions from log
items during log recovery.  In the old days ASSERT would halt the
kernel, but this isn't true any more so we have to make an explicit
error return.

Coverity-id: 1132508
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Chandan Babu R <chandan.babu@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index c1a514ffff55507e2986568868b7df915f3b00f8..094ae1a91c440b7365f6c22535bc2a160b284697 100644 (file)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -4293,7 +4293,16 @@ xlog_recover_add_to_trans(
                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
                                    0);
        }
-       ASSERT(item->ri_total > item->ri_cnt);
+
+       if (item->ri_total <= item->ri_cnt) {
+               xfs_warn(log->l_mp,
+       "log item region count (%d) overflowed size (%d)",
+                               item->ri_cnt, item->ri_total);
+               ASSERT(0);
+               kmem_free(ptr);
+               return -EFSCORRUPTED;
+       }
+
        /* Description region is ri_buf[0] */
        item->ri_buf[item->ri_cnt].i_addr = ptr;
        item->ri_buf[item->ri_cnt].i_len  = len;