• Darrick J. Wong's avatar
    xfs: fix maxicount division by zero error · c94613fe
    Darrick J. Wong authored
    In xfs_ialloc_setup_geometry, it's possible for a malicious/corrupt fs
    image to set an unreasonably large value for sb_inopblog which will
    cause ialloc_blks to be zero.  If sb_imax_pct is also set, this results
    in a division by zero error in the second do_div call.  Therefore, force
    maxicount to zero if ialloc_blks is zero.
    
    Note that the kernel metadata verifiers will catch the garbage inopblog
    value and abort the fs mount long before it tries to set up the inode
    geometry; this is needed to avoid a crash in xfs_db while setting up the
    xfs_mount structure.
    
    Found by fuzzing sb_inopblog to 122 in xfs/350.
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>
    Reviewed-by: default avatarCarlos Maiolino <cmaiolino@redhat.com>
    c94613fe
xfs_ialloc.c 77.5 KB