On Mon, Aug 26, 2019 at 02:48:56PM -0700, Darrick J. Wong wrote: > From: Darrick J. Wong <darrick.wong@xxxxxxxxxx> > > In xfs_ialloc_setup_geometry, it's possible for a malicious/corrupt fs > image to set an unreasonably large value for sb_inopblog which will > cause ialloc_blks to be zero. If sb_imax_pct is also set, this results > in a division by zero error in the second do_div call. Therefore, force > maxicount to zero if ialloc_blks is zero. > > Note that the kernel metadata verifiers will catch the garbage inopblog > value and abort the fs mount long before it tries to set up the inode > geometry; this is needed to avoid a crash in xfs_db while setting up the > xfs_mount structure. > > Found by fuzzing sb_inopblog to 122 in xfs/350. Harmless for the kernel, makes sense for shared code. Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx> -- Dave Chinner david@xxxxxxxxxxxxx
