Bug 509902 - xfs_repair arithmetic overflow for large filesystems
xfs_repair arithmetic overflow for large filesystems
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: xfsprogs (Show other bugs)
All Linux
low Severity medium
: rc
: ---
Assigned To: Eric Sandeen
Depends On:
  Show dependency treegraph
Reported: 2009-07-06 15:08 EDT by Eric Sandeen
Modified: 2009-11-06 11:55 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-11-06 11:55:08 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Eric Sandeen 2009-07-06 15:08:57 EDT
This is a recently-fixed problem upstream:


From: Eric Sandeen <sandeen@sandeen.net>
Date: Thu, 2 Jul 2009 05:29:36 +0000 (-0500)
Subject: xfs_repair: fix agcount*agblocks overflows
X-Git-Url: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs%2Fcmds%2Fxfsprogs.git;a=commitdiff_plain;h=003e8e41124707f55b20b376a6359dc7f6292991

xfs_repair: fix agcount*agblocks overflows

The last test in verify_ag_bno() may overflow:

return (agbno >= (sbp->sb_dblocks -
		((sbp->sb_agcount - 1) * sbp->sb_agblocks)));

because sb_agcount & sb_agblocks are 32-bit integers; this
may then miss corrupt agbnos for the last ag, which can in
turn lead to out of bounds memory accesses later, for example
when the block nr is used to offset in set_agbno_state():

	addr = ba_bmap[(agno)] + (ag_blockno)/XR_BB_NUM;

Similar problems in mk_incore_fstree

Reported-by: Jesse Stroik <jstroik@ssec.wisc.edu>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Reviewed-by: Felix Blyakher <felixb@sgi.com>

So when repairing large filesystems for which agcoung * agblocks is > 32 bits (basically, the sort of filesystems we're targetting here), this is a potential issue.  I'd like to get this fixed in RHEL5.4 if possible, it's a trivial fix.

Comment 3 Eric Sandeen 2009-07-09 13:10:34 EDT
Committed, built & tagged, xfsprogs-2_10_2-7_el5
Comment 7 errata-xmlrpc 2009-11-06 11:55:08 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.