mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 18:21:24 +02:00
704d48d81d
vxfs_bmap_typed() handles four typed-extent types and calls BUG() in
its default case, so an on-disk typed extent with any other type value
crashes the kernel. It is reachable from ioctl(FIBMAP) on a regular
file:
kernel BUG at fs/freevxfs/vxfs_bmap.c:230!
RIP: vxfs_bmap_typed fs/freevxfs/vxfs_bmap.c:230 [inline]
vxfs_bmap1+0x128a/0x12d0 fs/freevxfs/vxfs_bmap.c:257
Replace the BUG() with WARN_ON_ONCE() and return 0 -- the value
vxfs_bmap_typed() already returns on failure (and from the DEV4 case
above); vxfs_getblk() maps 0 to -EIO, so the ioctl fails cleanly.
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Link: https://patch.msgid.link/CA+0ovChveuAwv=t15dr2m09E32bM48hHJxvfeEYZOhdNiEc9Tw@mail.gmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| vxfs_bmap.c | ||
| vxfs_dir.h | ||
| vxfs_extern.h | ||
| vxfs_fshead.c | ||
| vxfs_fshead.h | ||
| vxfs_immed.c | ||
| vxfs_inode.c | ||
| vxfs_inode.h | ||
| vxfs_lookup.c | ||
| vxfs_olt.c | ||
| vxfs_olt.h | ||
| vxfs_subr.c | ||
| vxfs_super.c | ||
| vxfs.h | ||