packages/xfsprogs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xfs_io: fix mread with length 1 mod page size

Browse Source 
(cherry picked from commit 7562916a73a6101c7c70a03f9367d823c10da354)
This commit is contained in:
liuh 2024-06-19 18:04:00 +08:00 committed by openeuler-sync-bot
parent d7e5e75d30
commit a0a1e0f997
2 changed files with 78 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
0006-xfs_io-fix-mread-with-length-1-mod-page-size.patch Normal file
View File

@ -0,0 +1,72 @@
From 7ea701ffc7cf306a903f2966519b3f5aedfb77ea Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 11 Jun 2024 11:29:28 -0700
Subject: xfs_io: fix mread with length 1 mod page size
Fix a weird bug in mread where if you passed it a length that was 1
modulo the page size, for example
xfs_io -r file -c "mmap -r 0 8192" -c "mread -v 0 4097"
... it never reset its pointer into the buffer into which it copies the
data from the memory map. This caused an out-of-bounds write, which
depending on the length passed could be very large and reliably
segfault. Also nothing was printed, despite the use of -v option.
(I don't know if this case gets reached by any existing xfstest, but
presumably not. I noticed it while working on a patch to an xfstest.)
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
---
io/mmap.c | 20 ++++++--------------
1 file changed, 6 insertions(+), 14 deletions(-)
diff --git a/io/mmap.c b/io/mmap.c
index 425957d..a5f30e0 100644
--- a/io/mmap.c
+++ b/io/mmap.c
@@ -472,34 +472,26 @@ mread_f(
dumplen = pagesize;
if (rflag) {
- for (tmp = length - 1, c = 0; tmp >= 0; tmp--, c = 1) {
- *bp = *(((char *)mapping->addr) + dumpoffset + tmp);
- cnt++;
- if (c && cnt == dumplen) {
+ for (tmp = length - 1; tmp >= 0; tmp--) {
+ bp[cnt++] = ((char *)mapping->addr)[dumpoffset + tmp];
+ if (cnt == dumplen) {
if (dump) {
dump_buffer(printoffset, dumplen);
printoffset += dumplen;
}
- bp = (char *)io_buffer;
dumplen = pagesize;
cnt = 0;
- } else {
- bp++;
}
}
} else {
- for (tmp = 0, c = 0; tmp < length; tmp++, c = 1) {
- *bp = *(((char *)mapping->addr) + dumpoffset + tmp);
- cnt++;
- if (c && cnt == dumplen) {
+ for (tmp = 0; tmp < length; tmp++) {
+ bp[cnt++] = ((char *)mapping->addr)[dumpoffset + tmp];
+ if (cnt == dumplen) {
if (dump)
dump_buffer(printoffset + tmp -
(dumplen - 1), dumplen);
- bp = (char *)io_buffer;
dumplen = pagesize;
cnt = 0;
- } else {
- bp++;
}
}
}
--
2.43.0

7
xfsprogs.spec
View File

@ -1,6 +1,6 @@
Name: xfsprogs
Version: 6.6.0
Release: 5
Release: 6
Summary: Administration and debugging tools for the XFS file system
License: GPL+ and LGPLv2+
URL: https://xfs.wiki.kernel.org
@ -24,6 +24,7 @@ Patch2: 0002-xfs-fix-internal-error-from-AGFL-exhaustion.patch
Patch3: 0003-xfs_db-don-t-hardcode-type-data-size-at-512b.patch
Patch4: 0004-xfs_db-fix-leak-in-flist_find_ftyp.patch
Patch5: 0005-xfs_db-add-helper-for-flist_find_type-for-clearer-fi.patch
Patch6: 0006-xfs_io-fix-mread-with-length-1-mod-page-size.patch
%description
xfsprogs are the userspace utilities that manage XFS filesystems.
@ -107,6 +108,10 @@ rm -rf %{buildroot}%{_datadir}/doc/xfsprogs/
%changelog
* Fri Jun 21 2024 liuh <liuhuan01@kylinos.cn> - 6.6.0-6
- sync pathc from community
xfs_io: fix mread with length 1 mod page size
* Tue Jun 4 2024 liuh <liuhuan01@kylinos.cn> - 6.6.0-5
- sync patches from community