[PATCH] gfs2: Check gfs2_metatype_check() return value in revoke_lo_scan_elements()

[PATCH] gfs2: Check gfs2_metatype_check() return value in revoke_lo_scan_elements()

[Dmitriy Okunev]

revoke_lo_scan_elements() calls gfs2_metatype_check() on every log
block except the first one, but does not check its return value.
gfs2_metatype_check() verifies that the block magic and type match
GFS2_METATYPE_LB and, on mismatch, calls gfs2_withdraw(), which moves
the filesystem into a terminal state (SDF_WITHDRAWN).  The function
revoke_lo_scan_elements() keeps parsing the block as a valid
log descriptor, passes the garbage it reads to gfs2_revoke_add(),
and continues with the remaining blocks of the journal in the same
way, eventually returning 0 even though the filesystem has already
been withdrawn.

Check the return value gfs2_metatype_check() and in case of an
error bail out with -EIO.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: b3b94faa5fe5 ("[GFS2] The core of GFS2")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy@gmail.com>
---
 fs/gfs2/lops.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 6dabe73ad790..2aacd3f774ab 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -936,8 +936,12 @@ static int revoke_lo_scan_elements(struct gfs2_jdesc *jd, u32 start,
 		if (error)
 			return error;
 
-		if (!first)
-			gfs2_metatype_check(sdp, bh, GFS2_METATYPE_LB);
+		if (!first) {
+			if (gfs2_metatype_check(sdp, bh, GFS2_METATYPE_LB)) {
+				brelse(bh);
+				return -EIO;
+			}
+		}
 
 		while (offset + sizeof(u64) <= sdp->sd_sb.sb_bsize) {
 			blkno = be64_to_cpu(*(__be64 *)(bh->b_data + offset));
-- 
2.53.0