diff options
| author | Junrui Luo <moonafterrain@outlook.com> | 2026-04-04 15:44:35 +0800 |
|---|---|---|
| committer | Yu Kuai <yukuai@fnnas.com> | 2026-04-07 13:09:22 +0800 |
| commit | b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9 (patch) | |
| tree | b3ed4403483f7165a33e477dca84757e970b23be /scripts | |
| parent | e4979f4fac4d6bbe757be50441b45e28e6bf7360 (diff) | |
md/raid5: validate payload size before accessing journal metadata
r5c_recovery_analyze_meta_block() and
r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a
journal metadata block using on-disk payload size fields without
validating them against the remaining space in the metadata block.
A corrupted journal contains payload sizes extending beyond the PAGE_SIZE
boundary can cause out-of-bounds reads when accessing payload fields or
computing offsets.
Add bounds validation for each payload type to ensure the full payload
fits within meta_size before processing.
Fixes: b4c625c67362 ("md/r5cache: r5cache recovery: part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@SYBPR01MB7881.ausprd01.prod.outlook.com/
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions