This is a note to let you know that I've just added the patch titled xfs: check owner of dir3 blocks to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-check-owner-of-dir3-blocks.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Wed Oct 26 04:49:40 PM CEST 2022 From: Chandan Babu R <chandan.babu@xxxxxxxxxx> Date: Wed, 26 Oct 2022 11:58:25 +0530 Subject: xfs: check owner of dir3 blocks To: gregkh@xxxxxxxxxxxxxxxxxxx Cc: sashal@xxxxxxxxxx, mcgrof@xxxxxxxxxx, linux-xfs@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, djwong@xxxxxxxxxx, chandan.babu@xxxxxxxxxx, amir73il@xxxxxxxxx, leah.rumancik@xxxxxxxxx Message-ID: <20221026062843.927600-9-chandan.babu@xxxxxxxxxx> From: "Darrick J. Wong" <darrick.wong@xxxxxxxxxx> commit 1b2c1a63b678d63e9c98314d44413f5af79c9c80 upstream. Check the owner field of dir3 block headers. If it's corrupt, release the buffer and return EFSCORRUPTED. All callers handle this properly. Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx> Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx> Signed-off-by: Chandan Babu R <chandan.babu@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/xfs/libxfs/xfs_dir2_block.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) --- a/fs/xfs/libxfs/xfs_dir2_block.c +++ b/fs/xfs/libxfs/xfs_dir2_block.c @@ -114,6 +114,23 @@ const struct xfs_buf_ops xfs_dir3_block_ .verify_struct = xfs_dir3_block_verify, }; +static xfs_failaddr_t +xfs_dir3_block_header_check( + struct xfs_inode *dp, + struct xfs_buf *bp) +{ + struct xfs_mount *mp = dp->i_mount; + + if (xfs_sb_version_hascrc(&mp->m_sb)) { + struct xfs_dir3_blk_hdr *hdr3 = bp->b_addr; + + if (be64_to_cpu(hdr3->owner) != dp->i_ino) + return __this_address; + } + + return NULL; +} + int xfs_dir3_block_read( struct xfs_trans *tp, @@ -121,12 +138,24 @@ xfs_dir3_block_read( struct xfs_buf **bpp) { struct xfs_mount *mp = dp->i_mount; + xfs_failaddr_t fa; int err; err = xfs_da_read_buf(tp, dp, mp->m_dir_geo->datablk, -1, bpp, XFS_DATA_FORK, &xfs_dir3_block_buf_ops); - if (!err && tp && *bpp) - xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_BLOCK_BUF); + if (err || !*bpp) + return err; + + /* Check things that we can't do in the verifier. */ + fa = xfs_dir3_block_header_check(dp, *bpp); + if (fa) { + __xfs_buf_mark_corrupt(*bpp, fa); + xfs_trans_brelse(tp, *bpp); + *bpp = NULL; + return -EFSCORRUPTED; + } + + xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_BLOCK_BUF); return err; } Patches currently in stable-queue which might be from chandan.babu@xxxxxxxxxx are queue-5.4/xfs-check-owner-of-dir3-blocks.patch queue-5.4/xfs-throttle-commits-on-delayed-background-cil-push.patch queue-5.4/xfs-factor-common-ail-item-deletion-code.patch queue-5.4/xfs-remove-the-xfs_dq_logitem_t-typedef.patch queue-5.4/xfs-fix-buffer-corruption-reporting-when-xfs_dir3_free_header_check-fails.patch queue-5.4/xfs-xfs_buf_corruption_error-should-take-__this_address.patch queue-5.4/xfs-open-code-insert-range-extent-split-helper.patch queue-5.4/xfs-don-t-write-a-corrupt-unmount-record-to-force-summary-counter-recalc.patch queue-5.4/xfs-check-owner-of-dir3-data-blocks.patch queue-5.4/xfs-factor-out-quotaoff-intent-ail-removal-and-memory-free.patch queue-5.4/xfs-trylock-underlying-buffer-on-dquot-flush.patch queue-5.4/xfs-remove-the-xfs_disk_dquot_t-and-xfs_dquot_t.patch queue-5.4/xfs-add-a-function-to-deal-with-corrupt-buffers-post-verifiers.patch queue-5.4/xfs-fix-use-after-free-on-cil-context-on-shutdown.patch queue-5.4/xfs-tail-updates-only-need-to-occur-when-lsn-changes.patch queue-5.4/xfs-use-scnprintf-for-avoiding-potential-buffer-overflow.patch queue-5.4/xfs-move-inode-flush-to-the-sync-workqueue.patch queue-5.4/xfs-lower-cil-flush-limit-for-large-logs.patch queue-5.4/xfs-rework-collapse-range-into-an-atomic-operation.patch queue-5.4/xfs-remove-the-xfs_qoff_logitem_t-typedef.patch queue-5.4/xfs-fix-unmount-hang-and-memory-leak-on-shutdown-during-quotaoff.patch queue-5.4/xfs-preserve-default-grace-interval-during-quotacheck.patch queue-5.4/xfs-replace-function-declaration-by-actual-definition.patch queue-5.4/xfs-rework-insert-range-into-an-atomic-operation.patch queue-5.4/xfs-factor-out-a-new-xfs_log_force_inode-helper.patch queue-5.4/xfs-reflink-should-force-the-log-out-if-mounted-with-wsync.patch