xfs: range check ri_cnt when recovering log items

Range check the region counter when we're reassembling regions from log
items during log recovery.  In the old days ASSERT would halt the
kernel, but this isn't true any more so we have to make an explicit
error return.

Coverity-id: 1132508
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 648d5ecafd91b06529c7915009f8db2f0bb877f6..b0257ef9d29fecf34c70b9f44e6990a2c5e7a7cf 100644 (file)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -4301,7 +4301,16 @@ xlog_recover_add_to_trans(
                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
                                    0);
        }
-       ASSERT(item->ri_total > item->ri_cnt);
+
+       if (item->ri_total <= item->ri_cnt) {
+               xfs_warn(log->l_mp,
+       "log item region count (%d) overflowed size (%d)",
+                               item->ri_cnt, item->ri_total);
+               ASSERT(0);
+               kmem_free(ptr);
+               return -EFSCORRUPTED;
+       }
+
        /* Description region is ri_buf[0] */
        item->ri_buf[item->ri_cnt].i_addr = ptr;
        item->ri_buf[item->ri_cnt].i_len  = len;