diff mbox series

[2/2] xfs: check dabtree node hash values when loading child blocks

Message ID 160031331944.3624286.5979437788459484830.stgit@magnolia
State New
Headers show
Series xfs: random fixes | expand

Commit Message

Darrick J. Wong Sept. 17, 2020, 3:28 a.m. UTC
From: Darrick J. Wong <darrick.wong@oracle.com>

When xchk_da_btree_block is loading a non-root dabtree block, we know
that the parent block had to have a (hashval, address) pointer to the
block that we just loaded.  Check that the hashval in the parent matches
the block we just loaded.

This was found by fuzzing nbtree[3].hashval = ones in xfs/394.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/scrub/dabtree.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

Comments

Dave Chinner Sept. 17, 2020, 4:48 a.m. UTC | #1
On Wed, Sep 16, 2020 at 08:28:39PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> When xchk_da_btree_block is loading a non-root dabtree block, we know
> that the parent block had to have a (hashval, address) pointer to the
> block that we just loaded.  Check that the hashval in the parent matches
> the block we just loaded.
> 
> This was found by fuzzing nbtree[3].hashval = ones in xfs/394.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  fs/xfs/scrub/dabtree.c |   14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> 
> diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
> index e56786f0a13c..653f3280e1c1 100644
> --- a/fs/xfs/scrub/dabtree.c
> +++ b/fs/xfs/scrub/dabtree.c
> @@ -441,6 +441,20 @@ xchk_da_btree_block(
>  		goto out_freebp;
>  	}
>  
> +	/*
> +	 * If we've been handed a block that is below the dabtree root, does
> +	 * its hashval match what the parent block expected to see?
> +	 */
> +	if (level > 0) {
> +		struct xfs_da_node_entry	*key;
> +
> +		key = xchk_da_btree_node_entry(ds, level - 1);
> +		if (be32_to_cpu(key->hashval) != blk->hashval) {
> +			xchk_da_set_corrupt(ds, level);
> +			goto out_freebp;
> +		}
> +	}

Looks ok.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
Christoph Hellwig Sept. 17, 2020, 8:12 a.m. UTC | #2
On Wed, Sep 16, 2020 at 08:28:39PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> When xchk_da_btree_block is loading a non-root dabtree block, we know
> that the parent block had to have a (hashval, address) pointer to the
> block that we just loaded.  Check that the hashval in the parent matches
> the block we just loaded.
> 
> This was found by fuzzing nbtree[3].hashval = ones in xfs/394.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>
diff mbox series

Patch

diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index e56786f0a13c..653f3280e1c1 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -441,6 +441,20 @@  xchk_da_btree_block(
 		goto out_freebp;
 	}
 
+	/*
+	 * If we've been handed a block that is below the dabtree root, does
+	 * its hashval match what the parent block expected to see?
+	 */
+	if (level > 0) {
+		struct xfs_da_node_entry	*key;
+
+		key = xchk_da_btree_node_entry(ds, level - 1);
+		if (be32_to_cpu(key->hashval) != blk->hashval) {
+			xchk_da_set_corrupt(ds, level);
+			goto out_freebp;
+		}
+	}
+
 out:
 	return error;
 out_freebp: