aboutsummaryrefslogtreecommitdiffstats
path: root/fs/xfs/xfs_inode.c
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2009-01-18 20:04:16 -0500
committerChristoph Hellwig <hch@brick.lst.de>2009-01-18 20:04:16 -0500
commit2809f76afce05a73e08120f455107912aa519647 (patch)
tree7c5ae07404c59571d120dc8e2fa2e33db54b8e7d /fs/xfs/xfs_inode.c
parent7884bc8617e6b8afda8cb8853cf14abfd3148d5c (diff)
xfs: sanity check attr fork size
Recently we have quite a few kerneloops reports about dereferencing a NULL if_data in the attribute fork. From looking over the code this can only happen if we pass a 0 size argument to xfs_iformat_local. This implies some sort of corruption and in fact the only mailinglist report about this from earlier this year was after a powerfail presumably on a system with write cache and without barriers. Add a quick sanity check for the attr fork size in xfs_iformat to catch these early and without an oops. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Dave Chinner <david@fromorbit.com>
Diffstat (limited to 'fs/xfs/xfs_inode.c')
-rw-r--r--fs/xfs/xfs_inode.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index be2ca4d67b53..e7ae08d1df48 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -424,6 +424,19 @@ xfs_iformat(
424 case XFS_DINODE_FMT_LOCAL: 424 case XFS_DINODE_FMT_LOCAL:
425 atp = (xfs_attr_shortform_t *)XFS_DFORK_APTR(dip); 425 atp = (xfs_attr_shortform_t *)XFS_DFORK_APTR(dip);
426 size = be16_to_cpu(atp->hdr.totsize); 426 size = be16_to_cpu(atp->hdr.totsize);
427
428 if (unlikely(size < sizeof(struct xfs_attr_sf_hdr))) {
429 xfs_fs_repair_cmn_err(CE_WARN, ip->i_mount,
430 "corrupt inode %Lu "
431 "(bad attr fork size %Ld).",
432 (unsigned long long) ip->i_ino,
433 (long long) size);
434 XFS_CORRUPTION_ERROR("xfs_iformat(8)",
435 XFS_ERRLEVEL_LOW,
436 ip->i_mount, dip);
437 return XFS_ERROR(EFSCORRUPTED);
438 }
439
427 error = xfs_iformat_local(ip, dip, XFS_ATTR_FORK, size); 440 error = xfs_iformat_local(ip, dip, XFS_ATTR_FORK, size);
428 break; 441 break;
429 case XFS_DINODE_FMT_EXTENTS: 442 case XFS_DINODE_FMT_EXTENTS: