On Fri, Sep 06, 2024 at 02:11:17 PM -0700, Catherine Hoang wrote:
> From: Christoph Hellwig <hch@xxxxxx>
>
> commit 45cf976008ddef4a9c9a30310c9b4fb2a9a6602a upstream.
>
> [backport: resolve conflict due to kmem_free->kvfree conversion]
>
> Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by
> mkfs") added a fixup for incorrect h_size values used for the initial
> umount record in old xfsprogs versions. Later commit 0c771b99d6c9
> ("xfs: clean up calculation of LR header blocks") cleaned up the log
> reover buffer calculation, but stoped using the fixed up h_size value
> to size the log recovery buffer, which can lead to an out of bounds
> access when the incorrect h_size does not come from the old mkfs
> tool, but a fuzzer.
>
> Fix this by open coding xlog_logrec_hblks and taking the fixed h_size
> into account for this calculation.
Looks like this commit has already been backported to 6.6.y. Please refer to
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c2389c074973aa94e34992e7f66dac0de37595b5
--
Chandan
