Bug 509902

Summary: xfs_repair arithmetic overflow for large filesystems
Product: Red Hat Enterprise Linux 5 Reporter: Eric Sandeen <esandeen>
Component: xfsprogsAssignee: Eric Sandeen <esandeen>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: low    
Version: 5.4   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-11-06 16:55:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Eric Sandeen 2009-07-06 19:08:57 UTC 
This is a recently-fixed problem upstream:

http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs/cmds/xfsprogs.git;a=commitdiff;h=003e8e41124707f55b20b376a6359dc7f6292991

From: Eric Sandeen <sandeen>
Date: Thu, 2 Jul 2009 05:29:36 +0000 (-0500)
Subject: xfs_repair: fix agcount*agblocks overflows
X-Git-Url: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs%2Fcmds%2Fxfsprogs.git;a=commitdiff_plain;h=003e8e41124707f55b20b376a6359dc7f6292991

xfs_repair: fix agcount*agblocks overflows

The last test in verify_ag_bno() may overflow:

return (agbno >= (sbp->sb_dblocks -
		((sbp->sb_agcount - 1) * sbp->sb_agblocks)));

because sb_agcount & sb_agblocks are 32-bit integers; this
may then miss corrupt agbnos for the last ag, which can in
turn lead to out of bounds memory accesses later, for example
when the block nr is used to offset in set_agbno_state():

	addr = ba_bmap[(agno)] + (ag_blockno)/XR_BB_NUM;

Similar problems in mk_incore_fstree

Reported-by: Jesse Stroik <jstroik.edu>
Signed-off-by: Eric Sandeen <sandeen>
Reviewed-by: Felix Blyakher <felixb>
---

So when repairing large filesystems for which agcoung * agblocks is > 32 bits (basically, the sort of filesystems we're targetting here), this is a potential issue.  I'd like to get this fixed in RHEL5.4 if possible, it's a trivial fix.

Thanks,
-Eric
Comment 3 Eric Sandeen 2009-07-09 17:10:34 UTC 
Committed, built & tagged, xfsprogs-2_10_2-7_el5
Comment 7 errata-xmlrpc 2009-11-06 16:55:08 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2009-1558.html