Commit 3e89cfff authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Jialin Zhang
Browse files

xfs: fix memcpy fortify errors in CUI log format copying 

mainline inclusion
from mainline-v6.1-rc1
commit a38935c0
category: bugfix
bugzilla: 188220, https://gitee.com/openeuler/kernel/issues/I4KIAO
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a38935c03c7914a6ab22eefb750b259868ed5a4b



--------------------------------

Starting in 6.1, CONFIG_FORTIFY_SOURCE checks the length parameter of
memcpy.  Since we're already fixing problems with BUI item copying, we
should fix it everything else.

Refactor the xfs_cui_copy_format function to handle the copying of the
head and the flex array members separately.  While we're at it, fix a
minor validation deficiency in the recovery function.

Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
Reviewed-by: default avatarAllison Henderson <allison.henderson@oracle.com>
Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>

conflicts:
	fs/xfs/xfs_ondisk.h

Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 66a0cb28

fs/xfs/xfs_ondisk.h

+5 −0
Original line number Diff line number Diff line
@@ -134,9 +134,14 @@ xfs_check_ondisk_structs(void) 
	XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header,		16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_bui_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_bud_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_cui_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_cud_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_map_extent,		32);

	XFS_CHECK_STRUCT_SIZE(struct xfs_phys_extent,		16);



	XFS_CHECK_OFFSET(struct xfs_bui_log_format, bui_extents,	16);

	XFS_CHECK_OFFSET(struct xfs_cui_log_format, cui_extents,	16);



	/*

	 * The v5 superblock format extended several v4 header structures with

	 * additional data. While new fields are only accessible on v5

fs/xfs/xfs_refcount_item.c

+21 −24
Original line number Diff line number Diff line
@@ -598,28 +598,18 @@ static const struct xfs_item_ops xfs_cui_item_ops = { 
	.iop_relog	= xfs_cui_item_relog,

};



/*

 * Copy an CUI format buffer from the given buf, and into the destination

 * CUI format structure.  The CUI/CUD items were designed not to need any

 * special alignment handling.

 */

static int

static inline void

xfs_cui_copy_format(

	struct xfs_log_iovec		*buf,

	struct xfs_cui_log_format	*dst_cui_fmt)

	struct xfs_cui_log_format	*dst,

	const struct xfs_cui_log_format	*src)

{

	struct xfs_cui_log_format	*src_cui_fmt;

	uint				len;

	unsigned int			i;



	src_cui_fmt = buf->i_addr;

	len = xfs_cui_log_format_sizeof(src_cui_fmt->cui_nextents);

	memcpy(dst, src, offsetof(struct xfs_cui_log_format, cui_extents));



	if (buf->i_len == len) {

		memcpy(dst_cui_fmt, src_cui_fmt, len);

		return 0;

	}

	XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);

	return -EFSCORRUPTED;

	for (i = 0; i < src->cui_nextents; i++)

		memcpy(&dst->cui_extents[i], &src->cui_extents[i],

				sizeof(struct xfs_phys_extent));

}



/*
@@ -636,19 +626,26 @@ xlog_recover_cui_commit_pass2( 
	struct xlog_recover_item	*item,

	xfs_lsn_t			lsn)

{

	int				error;

	struct xfs_mount		*mp = log->l_mp;

	struct xfs_cui_log_item		*cuip;

	struct xfs_cui_log_format	*cui_formatp;

	size_t				len;



	cui_formatp = item->ri_buf[0].i_addr;



	cuip = xfs_cui_init(mp, cui_formatp->cui_nextents);

	error = xfs_cui_copy_format(&item->ri_buf[0], &cuip->cui_format);

	if (error) {

		xfs_cui_item_free(cuip);

		return error;

	if (item->ri_buf[0].i_len < xfs_cui_log_format_sizeof(0)) {

		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);

		return -EFSCORRUPTED;

	}



	len = xfs_cui_log_format_sizeof(cui_formatp->cui_nextents);

	if (item->ri_buf[0].i_len != len) {

		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);

		return -EFSCORRUPTED;

	}



	cuip = xfs_cui_init(mp, cui_formatp->cui_nextents);

	xfs_cui_copy_format(&cuip->cui_format, cui_formatp);

	atomic_set(&cuip->cui_next_extent, cui_formatp->cui_nextents);

	/*

	 * Insert the intent into the AIL directly and drop one reference so