Commit 66a0cb28 authored by Darrick J. Wong's avatar Darrick J. Wong Committed by Jialin Zhang
Browse files

xfs: fix memcpy fortify errors in BUI log format copying 

mainline inclusion
from mainline-v6.1-rc1
commit a38ebce1
category: bugfix
bugzilla: 188220, https://gitee.com/openeuler/kernel/issues/I4KIAO
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a38ebce1da271f480e47c3def4f810c6106b74a1



--------------------------------

Starting in 6.1, CONFIG_FORTIFY_SOURCE checks the length parameter of
memcpy.  Unfortunately, it doesn't handle flex arrays correctly:

------------[ cut here ]------------
memcpy: detected field-spanning write (size 48) of single field "dst_bui_fmt" at fs/xfs/xfs_bmap_item.c:628 (size 16)

Fix this by refactoring the xfs_bui_copy_format function to handle the
copying of the head and the flex array members separately.  While we're
at it, fix a minor validation deficiency in the recovery function.

Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
Reviewed-by: default avatarAllison Henderson <allison.henderson@oracle.com>
Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>

conflicts:
	fs/xfs/xfs_ondisk.h

Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent f57de41e

fs/xfs/xfs_bmap_item.c

+22 −24
Original line number Diff line number Diff line
@@ -590,28 +590,18 @@ static const struct xfs_item_ops xfs_bui_item_ops = { 
	.iop_relog	= xfs_bui_item_relog,

};



/*

 * Copy an BUI format buffer from the given buf, and into the destination

 * BUI format structure.  The BUI/BUD items were designed not to need any

 * special alignment handling.

 */

static int

static inline void

xfs_bui_copy_format(

	struct xfs_log_iovec		*buf,

	struct xfs_bui_log_format	*dst_bui_fmt)

	struct xfs_bui_log_format	*dst,

	const struct xfs_bui_log_format	*src)

{

	struct xfs_bui_log_format	*src_bui_fmt;

	uint				len;

	unsigned int			i;



	src_bui_fmt = buf->i_addr;

	len = xfs_bui_log_format_sizeof(src_bui_fmt->bui_nextents);

	memcpy(dst, src, offsetof(struct xfs_bui_log_format, bui_extents));



	if (buf->i_len == len) {

		memcpy(dst_bui_fmt, src_bui_fmt, len);

		return 0;

	}

	XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);

	return -EFSCORRUPTED;

	for (i = 0; i < src->bui_nextents; i++)

		memcpy(&dst->bui_extents[i], &src->bui_extents[i],

				sizeof(struct xfs_map_extent));

}



/*
@@ -628,23 +618,31 @@ xlog_recover_bui_commit_pass2( 
	struct xlog_recover_item	*item,

	xfs_lsn_t			lsn)

{

	int				error;

	struct xfs_mount		*mp = log->l_mp;

	struct xfs_bui_log_item		*buip;

	struct xfs_bui_log_format	*bui_formatp;

	size_t				len;



	bui_formatp = item->ri_buf[0].i_addr;



	if (item->ri_buf[0].i_len < xfs_bui_log_format_sizeof(0)) {

		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);

		return -EFSCORRUPTED;

	}



	if (bui_formatp->bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) {

		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);

		return -EFSCORRUPTED;

	}

	buip = xfs_bui_init(mp);

	error = xfs_bui_copy_format(&item->ri_buf[0], &buip->bui_format);

	if (error) {

		xfs_bui_item_free(buip);

		return error;



	len = xfs_bui_log_format_sizeof(bui_formatp->bui_nextents);

	if (item->ri_buf[0].i_len != len) {

		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);

		return -EFSCORRUPTED;

	}



	buip = xfs_bui_init(mp);

	xfs_bui_copy_format(&buip->bui_format, bui_formatp);

	atomic_set(&buip->bui_next_extent, bui_formatp->bui_nextents);

	/*

	 * Insert the intent into the AIL directly and drop one reference so

fs/xfs/xfs_ondisk.h

+4 −0
Original line number Diff line number Diff line
@@ -132,7 +132,11 @@ xfs_check_ondisk_structs(void) 
	XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format,	56);

	XFS_CHECK_STRUCT_SIZE(struct xfs_qoff_logformat,	20);

	XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header,		16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_bui_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_bud_log_format,	16);

	XFS_CHECK_STRUCT_SIZE(struct xfs_map_extent,		32);



	XFS_CHECK_OFFSET(struct xfs_bui_log_format, bui_extents,	16);

	/*

	 * The v5 superblock format extended several v4 header structures with

	 * additional data. While new fields are only accessible on v5