On 1/20/17 2:25 PM, Darrick J. Wong wrote:
> xfs_db doesn't check the filesystem geometry when it's mounting, which
> means that garbage agcount values can cause OOMs when we try to allocate
> all the per-AG incore metadata. If we see geometry that looks
> suspicious, try to derive the actual AG geometry to avoid crashing the
> system. This should help with xfs/1301 fuzzing.
>
> Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
> ---
> v2: Only modify sb_ag{blocks,count} if they seem insane -- use local
> variables to avoid screwing up the rest of the metadata.
> v3: Suggest a possible agcount value, but always restrict to 1 AG.
> v4: Remove the suggested agcount value and make sure we can't exit
> the program with an exitcode of zero.
ok, but insane_agcount doesn't need to be global...
> ---
> db/init.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-------
> 1 file changed, 74 insertions(+), 10 deletions(-)
>
>
> diff --git a/db/init.c b/db/init.c
> index ec1e274..e60ac66 100644
> --- a/db/init.c
> +++ b/db/init.c
> @@ -41,6 +41,7 @@ struct xfs_mount *mp;
> struct xlog xlog;
> libxfs_init_t x;
> xfs_agnumber_t cur_agno = NULLAGNUMBER;
> +static bool insane_agcount;
Not a fan of the global. Can you make it local, and then
do something like this:
if (sanitize_agount(&xmount, sbp))
insane_agount = true;
> static void
> usage(void)
> @@ -51,13 +52,80 @@ usage(void)
> exit(1);
> }
>
> +/* Try to load a superblock for the given agno, no verifiers. */
> +static bool
> +load_sb(
> + struct xfs_mount *mp,
> + xfs_agnumber_t agno,
> + struct xfs_sb *sbp)
Now this is always called with agno == 0, so is there any point
to the arg? Eh, I guess it's fine.
I can fix up the insane_agcount thing on the way in if you like.
-Eric
> +{
> + struct xfs_buf *bp;
> +
> + bp = libxfs_readbuf(mp->m_ddev_targp,
> + XFS_AG_DADDR(mp, agno, XFS_SB_DADDR),
> + 1 << (XFS_MAX_SECTORSIZE_LOG - BBSHIFT), 0, NULL);
> +
> + if (!bp || bp->b_error)
> + return false;
> +
> + /* copy SB from buffer to in-core, converting architecture as we go */
> + libxfs_sb_from_disk(sbp, XFS_BUF_TO_SBP(bp));
> + libxfs_putbuf(bp);
> + libxfs_purgebuf(bp);
> +
> + return true;
> +}
> +
> +/*
> + * If the agcount doesn't look sane, suggest a real agcount to the user,
> + * and pretend agcount = 1 to avoid OOMing libxfs_initialize_perag.
> + */
> +static void
> +sanitize_geometry(
> + struct xfs_mount *mp,
> + struct xfs_sb *sbp)
> +{
> + unsigned int blocklog;
> + unsigned int blocksize;
> + unsigned long long dblocks;
> +
> + /* If the geometry looks ok, we're done. */
> + if (sbp->sb_blocklog >= XFS_MIN_BLOCKSIZE_LOG &&
> + sbp->sb_blocklog <= XFS_MAX_BLOCKSIZE_LOG &&
> + sbp->sb_blocksize == (1 << sbp->sb_blocklog) &&
> + sbp->sb_dblocks * sbp->sb_blocksize <= x.dsize * x.dbsize &&
> + sbp->sb_dblocks <= XFS_MAX_DBLOCKS(sbp) &&
> + sbp->sb_dblocks >= XFS_MIN_DBLOCKS(sbp))
> + return;
> +
> + /* Check blocklog and blocksize */
> + blocklog = sbp->sb_blocklog;
> + blocksize = sbp->sb_blocksize;
> + if (blocklog < XFS_MIN_BLOCKSIZE_LOG ||
> + blocklog > XFS_MAX_BLOCKSIZE_LOG)
> + blocklog = libxfs_log2_roundup(blocksize);
> + if (blocksize != (1 << blocklog))
> + blocksize = (1 << blocksize);
> +
> + /* Clamp dblocks to the size of the device. */
> + dblocks = sbp->sb_dblocks;
> + if (dblocks > x.dsize * x.dbsize / blocksize)
> + dblocks = x.dsize * x.dbsize / blocksize;
> +
> + /* Assume 1 AG to avoid OOM. */
> + fprintf(stderr,
> +_("%s: device %s AG count is insane. Limiting reads to AG 0.\n"),
> + progname, fsdevice);
> + sbp->sb_agcount = 1;
> + insane_agcount = true;
> +}
> +
> void
> init(
> int argc,
> char **argv)
> {
> struct xfs_sb *sbp;
> - struct xfs_buf *bp;
> int c;
>
> setlocale(LC_ALL, "");
> @@ -124,20 +192,12 @@ init(
> */
> memset(&xmount, 0, sizeof(struct xfs_mount));
> libxfs_buftarg_init(&xmount, x.ddev, x.logdev, x.rtdev);
> - bp = libxfs_readbuf(xmount.m_ddev_targp, XFS_SB_DADDR,
> - 1 << (XFS_MAX_SECTORSIZE_LOG - BBSHIFT), 0, NULL);
> -
> - if (!bp || bp->b_error) {
> + if (!load_sb(&xmount, 0, &xmount.m_sb)) {
> fprintf(stderr, _("%s: %s is invalid (cannot read first 512 "
> "bytes)\n"), progname, fsdevice);
> exit(1);
> }
>
> - /* copy SB from buffer to in-core, converting architecture as we go */
> - libxfs_sb_from_disk(&xmount.m_sb, XFS_BUF_TO_SBP(bp));
> - libxfs_putbuf(bp);
> - libxfs_purgebuf(bp);
> -
> sbp = &xmount.m_sb;
> if (sbp->sb_magicnum != XFS_SB_MAGIC) {
> fprintf(stderr, _("%s: %s is not a valid XFS filesystem (unexpected SB magic number 0x%08x)\n"),
> @@ -148,6 +208,8 @@ init(
> }
> }
>
> + sanitize_geometry(&xmount, sbp);
> +
> mp = libxfs_mount(&xmount, sbp, x.ddev, x.logdev, x.rtdev,
> LIBXFS_MOUNT_DEBUGGER);
> if (!mp) {
> @@ -230,5 +292,7 @@ main(
> libxfs_device_close(x.logdev);
> if (x.rtdev)
> libxfs_device_close(x.rtdev);
> + if (insane_agcount && exitcode == 0)
> + exitcode = 1;
> return exitcode;
> }
>
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
