|
 |
e427d2 |
From 381bc5d98b2a8a65b1f559e31e67361a761aefee Mon Sep 17 00:00:00 2001
|
|
|
e427d2 |
From: Luis Henriques <lhenriques@suse.de>
|
|
|
e427d2 |
Date: Wed, 28 Oct 2020 15:55:50 +0000
|
|
|
e427d2 |
Subject: [PATCH 14/46] filefrag: handle invalid st_dev and blksize cases
|
|
|
e427d2 |
Content-Type: text/plain
|
|
|
e427d2 |
|
|
|
e427d2 |
It is possible to crash filefrag with a "Floating point exception" in
|
|
|
e427d2 |
two different scenarios:
|
|
|
e427d2 |
|
|
|
e427d2 |
1. When fstat() returns a device ID set to 0
|
|
|
e427d2 |
2. When FIGETBSZ ioctl returns a blocksize of 0
|
|
|
e427d2 |
|
|
|
e427d2 |
In both scenarios a divide-by-zero will occur in frag_report() because
|
|
|
e427d2 |
variable blksize will be set to zero.
|
|
|
e427d2 |
|
|
|
e427d2 |
I've managed to trigger this crash with an old CephFS kernel client,
|
|
|
e427d2 |
using xfstest generic/519. The first scenario has been fixed by kernel
|
|
|
e427d2 |
commit 75c9627efb72 ("ceph: map snapid to anonymous bdev ID"). The
|
|
|
e427d2 |
second scenario is also fixed with commit 8f97d1e99149 ("vfs: fix
|
|
|
e427d2 |
FIGETBSZ ioctl on an overlayfs file").
|
|
|
e427d2 |
|
|
|
e427d2 |
However, it is desirable to handle these two scenarios gracefully by
|
|
|
e427d2 |
checking these conditions explicitly.
|
|
|
e427d2 |
|
|
|
e427d2 |
Signed-off-by: Luis Henriques <lhenriques@suse.de>
|
|
|
e427d2 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
e427d2 |
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
|
|
|
e427d2 |
---
|
|
|
e427d2 |
misc/filefrag.c | 4 ++--
|
|
|
e427d2 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
e427d2 |
|
|
|
e427d2 |
diff --git a/misc/filefrag.c b/misc/filefrag.c
|
|
|
e427d2 |
index 032535f3..a5b9bfe9 100644
|
|
|
e427d2 |
--- a/misc/filefrag.c
|
|
|
e427d2 |
+++ b/misc/filefrag.c
|
|
|
e427d2 |
@@ -418,13 +418,13 @@ static int frag_report(const char *filename)
|
|
|
e427d2 |
goto out_close;
|
|
|
e427d2 |
}
|
|
|
e427d2 |
|
|
|
e427d2 |
- if (last_device != st.st_dev) {
|
|
|
e427d2 |
+ if ((last_device != st.st_dev) || !st.st_dev) {
|
|
|
e427d2 |
if (fstatfs(fd, &fsinfo) < 0) {
|
|
|
e427d2 |
rc = -errno;
|
|
|
e427d2 |
perror("fstatfs");
|
|
|
e427d2 |
goto out_close;
|
|
|
e427d2 |
}
|
|
|
e427d2 |
- if (ioctl(fd, FIGETBSZ, &blksize) < 0)
|
|
|
e427d2 |
+ if ((ioctl(fd, FIGETBSZ, &blksize) < 0) || !blksize)
|
|
|
e427d2 |
blksize = fsinfo.f_bsize;
|
|
|
e427d2 |
if (verbose)
|
|
|
e427d2 |
printf("Filesystem type is: %lx\n",
|
|
|
e427d2 |
--
|
|
|
e427d2 |
2.35.1
|
|
|
e427d2 |
|