xfs: validate ondisk/incore dquot flags

While loading dquot records off disk, make sure that the quota type
flags are the same between the incore dquot and the ondisk dquot.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>

diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 76353c9a723ee04be9b530a61d8031b30912da2f..7503c669556983acc3381b88a1fa8c89d44c7664 100644 (file)
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -23,6 +23,7 @@
 #include "xfs_trace.h"
 #include "xfs_log.h"
 #include "xfs_bmap_btree.h"
+#include "xfs_error.h"
 
 /*
  * Lock order:
@@ -524,13 +525,26 @@ xfs_dquot_alloc(
 }
 
 /* Copy the in-core quota fields in from the on-disk buffer. */
-STATIC void
+STATIC int
 xfs_dquot_from_disk(
        struct xfs_dquot        *dqp,
        struct xfs_buf          *bp)
 {
        struct xfs_disk_dquot   *ddqp = bp->b_addr + dqp->q_bufoffset;
 
+       /*
+        * Ensure that we got the type and ID we were looking for.
+        * Everything else was checked by the dquot buffer verifier.
+        */
+       if ((ddqp->d_flags & XFS_DQ_ALLTYPES) != dqp->dq_flags ||
+           ddqp->d_id != dqp->q_core.d_id) {
+               xfs_alert_tag(bp->b_mount, XFS_PTAG_VERIFIER_ERROR,
+                         "Metadata corruption detected at %pS, quota %u",
+                         __this_address, be32_to_cpu(dqp->q_core.d_id));
+               xfs_alert(bp->b_mount, "Unmount and run xfs_repair");
+               return -EFSCORRUPTED;
+       }
+
        /* copy everything from disk dquot to the incore dquot */
        memcpy(&dqp->q_core, ddqp, sizeof(struct xfs_disk_dquot));
 
@@ -544,6 +558,7 @@ xfs_dquot_from_disk(
 
        /* initialize the dquot speculative prealloc thresholds */
        xfs_dquot_set_prealloc_limits(dqp);
+       return 0;
 }
 
 /* Allocate and initialize the dquot buffer for this in-core dquot. */
@@ -617,9 +632,11 @@ xfs_qm_dqread(
         * further.
         */
        ASSERT(xfs_buf_islocked(bp));
-       xfs_dquot_from_disk(dqp, bp);
-
+       error = xfs_dquot_from_disk(dqp, bp);
        xfs_buf_relse(bp);
+       if (error)
+               goto err;
+
        *dqpp = dqp;
        return error;