Re: [PATCH v3] xfs: fix heap buffer overflow in xfs_bmbt_to_bmdr

[Hongling Zeng]

在 2026年07月30日 23:43, Darrick J. Wong 写道:
> Please take a breath and refrain from sending the same patch three times
> in ninety minutes.  Figure out what you want to change, run it through
> some testing, and only send it once you've stopped finding things to
> tweak.
>
> --D
  Thanks for the feedback. I apologize for the multiple versions - that 
was my mistake in not reviewing thoroughly enough before submitting.

  The v3 patch is in its final form. I would appreciate your review 
when you get a chance.

  Hongling

> On Thu, Jul 30, 2026 at 05:48:24PM +0800, Hongling Zeng wrote:
> > The xfs_bmbt_to_bmdr() function converts an in-memory btree root to
> > on-disk form during log recovery. It uses bb_numrecs from the source
> > to determine memcpy size without validating against the destination
> > fork capacity.
> >
> > Current code:
> >    dmxr = xfs_bmdr_maxrecs(dblocklen, 0);           // destination capacity
> >    ...
> >    dmxr = be16_to_cpu(dblock->bb_numrecs);          // overwrite with source value!
> >    memcpy(..., * dmxr);                              // may overflow destination!
> >
> > If bb_numrecs is larger than the destination fork capacity,
> > memcpy writes beyond the fork buffer, causing heap overflow.
> >
> > Fix by validating bb_numrecs against the destination capacity
> > before using it for memcpy operations.
> >
> > Cc: stable@xxxxxxxxxxxxxxx
> > Fixes: 8ea5682d0711 ("xfs: refactor log recovery item dispatch for pass2 readhead functions")
> > Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> > ---
> > Change in v3:
> > - Use dmxr for tpp calculation (on-disk format) and nrecs for memcpy (actual records)
> > ---
> > Change in v2:
> > - Ensure memcpy operations consistently use nrecs instead of dmxr.
> > ---
> >   fs/xfs/libxfs/xfs_bmap_btree.c | 12 +++++++++---
> >   1 file changed, 9 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
> > index 758a4b1ccf5b..a119053d67b5 100644
> > --- a/fs/xfs/libxfs/xfs_bmap_btree.c
> > +++ b/fs/xfs/libxfs/xfs_bmap_btree.c
> > @@ -151,6 +151,7 @@ xfs_bmbt_to_bmdr(
> >   	int			dmxr;
> >   	xfs_bmbt_key_t		*fkp;
> >   	__be64			*fpp;
> > +	int                     nrecs;
> >   	xfs_bmbt_key_t		*tkp;
> >   	__be64			*tpp;
> >   
> > @@ -167,14 +168,19 @@ xfs_bmbt_to_bmdr(
> >   	ASSERT(rblock->bb_level != 0);
> >   	dblock->bb_level = rblock->bb_level;
> >   	dblock->bb_numrecs = rblock->bb_numrecs;
> > +
> > +	/* Validate record count against destination fork capacity */
> > +	nrecs = be16_to_cpu(rblock->bb_numrecs);
> >   	dmxr = xfs_bmdr_maxrecs(dblocklen, 0);
> > +	if (nrecs > dmxr)
> > +		return;
> > +
> >   	fkp = xfs_bmbt_key_addr(mp, rblock, 1);
> >   	tkp = xfs_bmdr_key_addr(dblock, 1);
> >   	fpp = xfs_bmap_broot_ptr_addr(mp, rblock, 1, rblocklen);
> >   	tpp = xfs_bmdr_ptr_addr(dblock, 1, dmxr);
> > -	dmxr = be16_to_cpu(dblock->bb_numrecs);
> > -	memcpy(tkp, fkp, sizeof(*fkp) * dmxr);
> > -	memcpy(tpp, fpp, sizeof(*fpp) * dmxr);
> > +	memcpy(tkp, fkp, sizeof(*fkp) * nrecs);
> > +	memcpy(tpp, fpp, sizeof(*fpp) * nrecs);
> >   }
> >   
> >   STATIC struct xfs_btree_cur *
> > --
> > 2.25.1