This is a recently-fixed problem upstream: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs/cmds/xfsprogs.git;a=commitdiff;h=003e8e41124707f55b20b376a6359dc7f6292991 From: Eric Sandeen <sandeen> Date: Thu, 2 Jul 2009 05:29:36 +0000 (-0500) Subject: xfs_repair: fix agcount*agblocks overflows X-Git-Url: http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs%2Fcmds%2Fxfsprogs.git;a=commitdiff_plain;h=003e8e41124707f55b20b376a6359dc7f6292991 xfs_repair: fix agcount*agblocks overflows The last test in verify_ag_bno() may overflow: return (agbno >= (sbp->sb_dblocks - ((sbp->sb_agcount - 1) * sbp->sb_agblocks))); because sb_agcount & sb_agblocks are 32-bit integers; this may then miss corrupt agbnos for the last ag, which can in turn lead to out of bounds memory accesses later, for example when the block nr is used to offset in set_agbno_state(): addr = ba_bmap[(agno)] + (ag_blockno)/XR_BB_NUM; Similar problems in mk_incore_fstree Reported-by: Jesse Stroik <jstroik.edu> Signed-off-by: Eric Sandeen <sandeen> Reviewed-by: Felix Blyakher <felixb> --- So when repairing large filesystems for which agcoung * agblocks is > 32 bits (basically, the sort of filesystems we're targetting here), this is a potential issue. I'd like to get this fixed in RHEL5.4 if possible, it's a trivial fix. Thanks, -Eric
Committed, built & tagged, xfsprogs-2_10_2-7_el5
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHEA-2009-1558.html