dm vdo: additional metadata validation

We identified a few places where dm-vdo uses a value from storage without sanity-checking that its value makes sense. Adding additional checks can prevent additional metadata corruption in the unusual cases where these values get corrupted.

Matthew Sakai (2):
dm vdo indexer: validate saved zone count dm vdo slab-depot: validate old zone count on load

 drivers/md/dm-vdo/indexer/index-layout.c | 3 +++
 drivers/md/dm-vdo/slab-depot.c           | 4 ++++
 2 files changed, 7 insertions(+)

2.48.1

Verify that the loaded zone count is in the valid range before using it as a loop iterator.

---
 drivers/md/dm-vdo/indexer/index-layout.c | 3 +++
 1 file changed, 3 insertions(+)

index 61edf2b72427..37144249f7ba 100644
@@ -1445,6 +1445,9 @@ static int __must_check reconstruct_index_save(struct index_save_layout *isl,
 	u64 last_block = next_block + isl->index_save.block_count;
 
 	isl->zone_count = table->header.region_count - 3;
+	if (isl->zone_count > MAX_ZONES)
+		return vdo_log_error_strerror(UDS_CORRUPT_DATA,
+					      "invalid zone count");
 
 	last_region = &table->regions[table->header.region_count - 1];
 	if (last_region->kind == RL_KIND_EMPTY) {

2.48.1

I just found a bug in this. The new check is actually too strict and prevents some valid cases from working correctly.

Please ignore this version. I'll send an update once I'm sure I've got it right.

Matt

Verify the old zone count has a valid value before using it to compute slab summary entry offsets.

---
 drivers/md/dm-vdo/slab-depot.c | 4 ++++
 1 file changed, 4 insertions(+)

index 034ecaa51f48..ad00afc2c168 100644
@@ -4262,6 +4262,10 @@ int vdo_decode_slab_depot(struct slab_depot_state_2_0 state, struct vdo *vdo,
 	}
 	slab_size_shift = ilog2(slab_size);
 
+	if (state.zone_count > MAX_VDO_PHYSICAL_ZONES)
+		return vdo_log_error_strerror(UDS_CORRUPT_DATA,
+					      "invalid zone count");
+
 	result = vdo_allocate_extended(struct slab_depot,
 				       vdo->thread_config.physical_zone_count,
 				       struct block_allocator, __func__, &depot);

2.48.1