From: Christoph Hellwig <hch@infradead.org>
To: Sam Sun <samsun1006219@gmail.com>
Cc: linux-kernel@vger.kernel.org, linux-xfs@vger.kernel.org,
djwong@kernel.org, chandan.babu@oracle.com,
syzkaller-bugs@googlegroups.com, xrivendell7@gmail.com,
Brian Foster <bfoster@redhat.com>
Subject: Re: [Linux kernel bug] KASAN: slab-out-of-bounds Read in xlog_cksum
Date: Thu, 25 Apr 2024 06:12:23 -0700 [thread overview]
Message-ID: <ZipWt03PhXs2Yc84@infradead.org> (raw)
In-Reply-To: <CAEkJfYO++C-pxyqzfoXFKEvmMQEnrgkQ2QcG6radAWJMqdXQCQ@mail.gmail.com>
This triggers the workaround for really old xfsprogs putting in a
bogus h_size:
[ 12.101992] XFS (loop0): invalid iclog size (0 bytes), using lsunit (65536 bytes)
but then calculates the log recovery buffer size based on the actual
on-disk h_size value. The patch below open codes xlog_logrec_hblks and
fixes this particular reproducer. But I wonder if we should limit the
workaround. Brian, you don't happpen to remember how old xfsprogs had
to be to require your workaround (commit a70f9fe52daa8)?
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b445e8ce4a7d21..b3ea546508dc93 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2999,7 +2999,7 @@ xlog_do_recovery_pass(
int error = 0, h_size, h_len;
int error2 = 0;
int bblks, split_bblks;
- int hblks, split_hblks, wrapped_hblks;
+ int hblks = 1, split_hblks, wrapped_hblks;
int i;
struct hlist_head rhash[XLOG_RHASH_SIZE];
LIST_HEAD (buffer_list);
@@ -3055,14 +3055,16 @@ xlog_do_recovery_pass(
if (error)
goto bread_err1;
- hblks = xlog_logrec_hblks(log, rhead);
- if (hblks != 1) {
- kvfree(hbp);
- hbp = xlog_alloc_buffer(log, hblks);
+ if ((rhead->h_version & cpu_to_be32(XLOG_VERSION_2)) &&
+ h_size > XLOG_HEADER_CYCLE_SIZE) {
+ hblks = DIV_ROUND_UP(h_size, XLOG_HEADER_CYCLE_SIZE);
+ if (hblks > 1) {
+ kvfree(hbp);
+ hbp = xlog_alloc_buffer(log, hblks);
+ }
}
} else {
ASSERT(log->l_sectBBsize == 1);
- hblks = 1;
hbp = xlog_alloc_buffer(log, 1);
h_size = XLOG_BIG_RECORD_BSIZE;
}
next prev parent reply other threads:[~2024-04-25 13:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-24 11:38 [Linux kernel bug] KASAN: slab-out-of-bounds Read in xlog_cksum Sam Sun
2024-04-25 13:12 ` Christoph Hellwig [this message]
2024-04-25 13:57 ` Brian Foster
2024-04-26 6:13 ` Christoph Hellwig
2024-04-26 12:46 ` Brian Foster
2024-04-26 21:36 ` Dave Chinner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZipWt03PhXs2Yc84@infradead.org \
--to=hch@infradead.org \
--cc=bfoster@redhat.com \
--cc=chandan.babu@oracle.com \
--cc=djwong@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=samsun1006219@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xrivendell7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.