diff options
| author | Luis Henriques <lhenriques@suse.de> | 2020-10-28 15:55:50 +0000 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2021-01-19 23:43:29 -0500 |
| commit | c57857a514d46535bf81f4fd3d0635ffc9df7490 (patch) | |
| tree | d73e3bd3f0f0450bd2868e9690855231b3f1074f | |
| parent | 7616fd6a599e44c5700c2c3a2e08979c6c5c747e (diff) | |
| download | e2fsprogs-c57857a514d46535bf81f4fd3d0635ffc9df7490.tar.gz | |
filefrag: handle invalid st_dev and blksize cases
It is possible to crash filefrag with a "Floating point exception" in
two different scenarios:
1. When fstat() returns a device ID set to 0
2. When FIGETBSZ ioctl returns a blocksize of 0
In both scenarios a divide-by-zero will occur in frag_report() because
variable blksize will be set to zero.
I've managed to trigger this crash with an old CephFS kernel client,
using xfstest generic/519. The first scenario has been fixed by kernel
commit 75c9627efb72 ("ceph: map snapid to anonymous bdev ID"). The
second scenario is also fixed with commit 8f97d1e99149 ("vfs: fix
FIGETBSZ ioctl on an overlayfs file").
However, it is desirable to handle these two scenarios gracefully by
checking these conditions explicitly.
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
| -rw-r--r-- | misc/filefrag.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/misc/filefrag.c b/misc/filefrag.c index 032535f38..a5b9bfe92 100644 --- a/misc/filefrag.c +++ b/misc/filefrag.c @@ -418,13 +418,13 @@ static int frag_report(const char *filename) goto out_close; } - if (last_device != st.st_dev) { + if ((last_device != st.st_dev) || !st.st_dev) { if (fstatfs(fd, &fsinfo) < 0) { rc = -errno; perror("fstatfs"); goto out_close; } - if (ioctl(fd, FIGETBSZ, &blksize) < 0) + if ((ioctl(fd, FIGETBSZ, &blksize) < 0) || !blksize) blksize = fsinfo.f_bsize; if (verbose) printf("Filesystem type is: %lx\n", |