From patchwork Sat Jan 21 00:15:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darrick J. Wong" X-Patchwork-Id: 9529733 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 14F796020B for ; Sat, 21 Jan 2017 00:15:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E8A302870A for ; Sat, 21 Jan 2017 00:15:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DD8092870C; Sat, 21 Jan 2017 00:15:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 355B32870A for ; Sat, 21 Jan 2017 00:15:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752321AbdAUAPR (ORCPT ); Fri, 20 Jan 2017 19:15:17 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:33838 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752327AbdAUAPM (ORCPT ); Fri, 20 Jan 2017 19:15:12 -0500 Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v0L0F9uT001362 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 21 Jan 2017 00:15:10 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v0L0F7EE013889 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 21 Jan 2017 00:15:07 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v0L0F63B015643; Sat, 21 Jan 2017 00:15:06 GMT Received: from localhost (/24.21.211.40) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 20 Jan 2017 16:15:06 -0800 Date: Fri, 20 Jan 2017 16:15:05 -0800 From: "Darrick J. Wong" To: sandeen@redhat.com Cc: linux-xfs@vger.kernel.org Subject: [PATCH v5 1/5] xfs_db: sanitize geometry on load Message-ID: <20170121001505.GK12985@birch.djwong.org> References: <148494391629.5256.3328772079712970611.stgit@birch.djwong.org> <148494392247.5256.10692618169002348643.stgit@birch.djwong.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <148494392247.5256.10692618169002348643.stgit@birch.djwong.org> User-Agent: Mutt/1.5.24 (2015-08-30) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-xfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP xfs_db doesn't check the filesystem geometry when it's mounting, which means that garbage agcount values can cause OOMs when we try to allocate all the per-AG incore metadata. If we see geometry that looks suspicious, try to derive the actual AG geometry to avoid crashing the system. This should help with xfs/1301 fuzzing. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen --- v2: Only modify sb_ag{blocks,count} if they seem insane -- use local variables to avoid screwing up the rest of the metadata. v3: Suggest a possible agcount value, but always restrict to 1 AG. v4: Remove the suggested agcount value and make sure we can't exit the program with an exitcode of zero. v5: remove global variables and unnecessary parameters --- db/init.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 77 insertions(+), 12 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-xfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/db/init.c b/db/init.c index ec1e274..0c684a5 100644 --- a/db/init.c +++ b/db/init.c @@ -51,13 +51,81 @@ usage(void) exit(1); } +/* Try to load a superblock for the given agno, no verifiers. */ +static bool +load_sb( + struct xfs_mount *mp, + struct xfs_sb *sbp) +{ + struct xfs_buf *bp; + + bp = libxfs_readbuf(mp->m_ddev_targp, XFS_SB_DADDR, + 1 << (XFS_MAX_SECTORSIZE_LOG - BBSHIFT), 0, NULL); + + if (!bp || bp->b_error) + return false; + + /* copy SB from buffer to in-core, converting architecture as we go */ + libxfs_sb_from_disk(sbp, XFS_BUF_TO_SBP(bp)); + libxfs_putbuf(bp); + libxfs_purgebuf(bp); + + return true; +} + +/* + * If the agcount doesn't look sane, suggest a real agcount to the user, + * and pretend agcount = 1 to avoid OOMing libxfs_initialize_perag. + * Returns true if the geometry was sane. + */ +static bool +sanitize_geometry( + struct xfs_mount *mp, + struct xfs_sb *sbp) +{ + unsigned int blocklog; + unsigned int blocksize; + unsigned long long dblocks; + + /* If the geometry looks ok, we're done. */ + if (sbp->sb_blocklog >= XFS_MIN_BLOCKSIZE_LOG && + sbp->sb_blocklog <= XFS_MAX_BLOCKSIZE_LOG && + sbp->sb_blocksize == (1 << sbp->sb_blocklog) && + sbp->sb_dblocks * sbp->sb_blocksize <= x.dsize * x.dbsize && + sbp->sb_dblocks <= XFS_MAX_DBLOCKS(sbp) && + sbp->sb_dblocks >= XFS_MIN_DBLOCKS(sbp)) + return true; + + /* Check blocklog and blocksize */ + blocklog = sbp->sb_blocklog; + blocksize = sbp->sb_blocksize; + if (blocklog < XFS_MIN_BLOCKSIZE_LOG || + blocklog > XFS_MAX_BLOCKSIZE_LOG) + blocklog = libxfs_log2_roundup(blocksize); + if (blocksize != (1 << blocklog)) + blocksize = (1 << blocksize); + + /* Clamp dblocks to the size of the device. */ + dblocks = sbp->sb_dblocks; + if (dblocks > x.dsize * x.dbsize / blocksize) + dblocks = x.dsize * x.dbsize / blocksize; + + /* Assume 1 AG to avoid OOM. */ + fprintf(stderr, +_("%s: device %s AG count is insane. Limiting reads to AG 0.\n"), + progname, fsdevice); + sbp->sb_agcount = 1; + + return false; +} + void init( int argc, - char **argv) + char **argv, + bool *insane_agcount) { struct xfs_sb *sbp; - struct xfs_buf *bp; int c; setlocale(LC_ALL, ""); @@ -124,20 +192,12 @@ init( */ memset(&xmount, 0, sizeof(struct xfs_mount)); libxfs_buftarg_init(&xmount, x.ddev, x.logdev, x.rtdev); - bp = libxfs_readbuf(xmount.m_ddev_targp, XFS_SB_DADDR, - 1 << (XFS_MAX_SECTORSIZE_LOG - BBSHIFT), 0, NULL); - - if (!bp || bp->b_error) { + if (!load_sb(&xmount, &xmount.m_sb)) { fprintf(stderr, _("%s: %s is invalid (cannot read first 512 " "bytes)\n"), progname, fsdevice); exit(1); } - /* copy SB from buffer to in-core, converting architecture as we go */ - libxfs_sb_from_disk(&xmount.m_sb, XFS_BUF_TO_SBP(bp)); - libxfs_putbuf(bp); - libxfs_purgebuf(bp); - sbp = &xmount.m_sb; if (sbp->sb_magicnum != XFS_SB_MAGIC) { fprintf(stderr, _("%s: %s is not a valid XFS filesystem (unexpected SB magic number 0x%08x)\n"), @@ -148,6 +208,8 @@ init( } } + *insane_agcount = !sanitize_geometry(&xmount, sbp); + mp = libxfs_mount(&xmount, sbp, x.ddev, x.logdev, x.rtdev, LIBXFS_MOUNT_DEBUGGER); if (!mp) { @@ -190,10 +252,11 @@ main( int c, i, done = 0; char *input; char **v; + bool insane_agcount; int start_iocur_sp; pushfile(stdin); - init(argc, argv); + init(argc, argv, &insane_agcount); start_iocur_sp = iocur_sp; for (i = 0; !done && i < ncmdline; i++) { @@ -230,5 +293,7 @@ main( libxfs_device_close(x.logdev); if (x.rtdev) libxfs_device_close(x.rtdev); + if (insane_agcount && exitcode == 0) + exitcode = 1; return exitcode; }