diff options
author | Eric Sandeen <sandeen@redhat.com> | 2014-11-27 22:03:55 -0500 |
---|---|---|
committer | Dave Chinner <david@fromorbit.com> | 2014-11-27 22:03:55 -0500 |
commit | db52d09ecbf85c54e263a9d1ebfb615a9b2b3ba6 (patch) | |
tree | 7c7ede18b9f3531f1831019a79e9c6dfa6edc83e /fs/xfs/xfs_icache.c | |
parent | 91ee575f2b35d1307412f917787195c2f6a38dfb (diff) |
xfs: catch invalid negative blknos in _xfs_buf_find()
Here blkno is a daddr_t, which is a __s64; it's possible to hold
a value which is negative, and thus pass the (blkno >= eofs)
test. Then we try to do a xfs_perag_get() for a ridiculous
agno via xfs_daddr_to_agno(), and bad things happen when that
fails, and returns a null pag which is dereferenced shortly
thereafter.
Found via a user-supplied fuzzed image...
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_icache.c')
0 files changed, 0 insertions, 0 deletions