From 79d1a532522f2e76fe75017fbb24cf4d71af6291 Mon Sep 17 00:00:00 2001 From: Zheng Bin Date: Wed, 18 Mar 2020 18:40:57 +0800 Subject: [PATCH] xfs: avoid f_bfree overflow hulk inclusion category: bugfix bugzilla: 31088 CVE: NA --------------------------- If fdblocks < mp->m_alloc_set_aside, statp->f_bfree will overflow. When we df -h /mnt(xfs mount point), will show this: Filesystem Size Used Avail Use% Mounted on /dev/loop0 17M -64Z -32K 100% /mnt We can construct an img like this: dd if=/dev/zero of=xfs.img bs=1M count=20 mkfs.xfs -d agcount=1 xfs.img xfs_db -x xfs.img sb 0 write fdblocks 0 agf 0 write freeblks 0 write longest 0 quit Make sure statp->f_bfree does not underflow. Signed-off-by: Zheng Bin Reviewed-by: Hou Tao Signed-off-by: Yang Yingliang --- fs/xfs/xfs_super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c index dce8114e3198..e126bc6cdeb8 100644 --- a/fs/xfs/xfs_super.c +++ b/fs/xfs/xfs_super.c @@ -1114,7 +1114,8 @@ xfs_fs_statfs( statp->f_blocks = sbp->sb_dblocks - lsize; spin_unlock(&mp->m_sb_lock); - statp->f_bfree = fdblocks - mp->m_alloc_set_aside; + /* make sure statp->f_bfree does not underflow */ + statp->f_bfree = max_t(int64_t, fdblocks - mp->m_alloc_set_aside, 0); statp->f_bavail = statp->f_bfree; fakeinos = statp->f_bfree << sbp->sb_inopblog; -- GitLab