On 11/19/14 16:12, Eric Sandeen wrote:
Here blkno is a daddr_t, which is a __s64; it's possible to hold
a value which is negative, and thus pass the (blkno>= eofs)
test. Then we try to do a xfs_perag_get() for a ridiculous
agno via xfs_daddr_to_agno(), and bad things happen when that
fails, and returns a null pag which is dereferenced shortly
thereafter.
Found via a user-supplied fuzzed image...
Signed-off-by: Eric Sandeen<sandeen@xxxxxxxxxx>
---
Looks good.
I did a little playing with sending the try lock failure (EAGAIN?) and
EFSCORRUPT error status up the stack. It looked straight forward and
could save a xfs_buf allocation when we know it is not necessary.
Reviewed-by: Mark Tinguely <tinguely@xxxxxxx>
_______________________________________________
xfs mailing list
xfs@xxxxxxxxxxx
http://oss.sgi.com/mailman/listinfo/xfs
