diff mbox series

[3/7] xfs_repair: junk corrupt xattr root blocks

Message ID 159950113638.567790.12521493655366784663.stgit@magnolia (mailing list archive)
State Accepted
Headers show
Series xfs_repair: more fuzzer fixes | expand

Commit Message

Darrick J. Wong Sept. 7, 2020, 5:52 p.m. UTC 
From: Darrick J. Wong <darrick.wong@oracle.com>

If reading the root block of an extended attribute structure fails due
to a corruption error, we should junk the block since we know it's bad.
There's no point in moving on to the (rather insufficient) checks in the
attr code.

Found by fuzzing hdr.freemap[1].base = ones in xfs/400.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 repair/attr_repair.c |    9 +++++++++
 1 file changed, 9 insertions(+)

Comments

Christoph Hellwig Sept. 8, 2020, 2:47 p.m. UTC | #1 
On Mon, Sep 07, 2020 at 10:52:16AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> If reading the root block of an extended attribute structure fails due
> to a corruption error, we should junk the block since we know it's bad.
> There's no point in moving on to the (rather insufficient) checks in the
> attr code.
> 
> Found by fuzzing hdr.freemap[1].base = ones in xfs/400.

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>
diff mbox series

Patch

diff --git a/repair/attr_repair.c b/repair/attr_repair.c
index 6cec0f7075d5..d92909e1c831 100644
--- a/repair/attr_repair.c
+++ b/repair/attr_repair.c
@@ -1107,6 +1107,15 @@  process_longform_attr(
 			ino);
 		return 1;
 	}
+
+	if (bp->b_error == -EFSCORRUPTED) {
+		do_warn(
+	_("corrupt block 0 of inode %" PRIu64 " attribute fork\n"),
+			ino);
+		libxfs_buf_relse(bp);
+		return 1;
+	}
+
 	if (bp->b_error == -EFSBADCRC)
 		(*repair)++;