xfs: avoid LR buffer overrun due to crafted h_len
authorGao Xiang <hsiangkao@redhat.com>
Tue, 22 Sep 2020 16:41:06 +0000 (09:41 -0700)
committerDarrick J. Wong <darrick.wong@oracle.com>
Wed, 23 Sep 2020 15:58:52 +0000 (08:58 -0700)
commitf692d09e9c8fd0f5557c2e87f796a16dd95222b8
tree90190165b7b714a83a53fdf69f3fc2c976850c7c
parent384ff09ba2e5170a0eec8d4af57065a47c3f8ef2
xfs: avoid LR buffer overrun due to crafted h_len

Currently, crafted h_len has been blocked for the log
header of the tail block in commit a70f9fe52daa ("xfs:
detect and handle invalid iclog size set by mkfs").

However, each log record could still have crafted h_len
and cause log record buffer overrun. So let's check
h_len vs buffer size for each log record as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
fs/xfs/xfs_log_recover.c