Commit 2bed0d82 authored by Dave Chinner's avatar Dave Chinner Committed by Darrick J. Wong
Browse files

xfs: fix bounds check in xfs_defer_agfl_block() 



Need to happen before we allocate and then leak the xefi. Found by
coverity via an xfsprogs libxfs scan.

[djwong: This also fixes the type of the @agbno argument.]

Fixes: 7dfee17b ("xfs: validate block number being freed before adding to xefi")
Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
parent edd8276d

fs/xfs/libxfs/xfs_alloc.c

+6 −5
Original line number Diff line number Diff line
@@ -2470,25 +2470,26 @@ static int 
xfs_defer_agfl_block(

	struct xfs_trans		*tp,

	xfs_agnumber_t			agno,

	xfs_fsblock_t			agbno,

	xfs_agblock_t			agbno,

	struct xfs_owner_info		*oinfo)

{

	struct xfs_mount		*mp = tp->t_mountp;

	struct xfs_extent_free_item	*xefi;

	xfs_fsblock_t			fsbno = XFS_AGB_TO_FSB(mp, agno, agbno);



	ASSERT(xfs_extfree_item_cache != NULL);

	ASSERT(oinfo != NULL);



	if (XFS_IS_CORRUPT(mp, !xfs_verify_fsbno(mp, fsbno)))

		return -EFSCORRUPTED;



	xefi = kmem_cache_zalloc(xfs_extfree_item_cache,

			       GFP_KERNEL | __GFP_NOFAIL);

	xefi->xefi_startblock = XFS_AGB_TO_FSB(mp, agno, agbno);

	xefi->xefi_startblock = fsbno;

	xefi->xefi_blockcount = 1;

	xefi->xefi_owner = oinfo->oi_owner;

	xefi->xefi_agresv = XFS_AG_RESV_AGFL;



	if (XFS_IS_CORRUPT(mp, !xfs_verify_fsbno(mp, xefi->xefi_startblock)))

		return -EFSCORRUPTED;



	trace_xfs_agfl_free_defer(mp, agno, 0, agbno, 1);



	xfs_extent_free_get_group(mp, xefi);