From 00aad56578294258442433b660d4c9ad59bc9d97 Mon Sep 17 00:00:00 2001 From: Matthew Sakai Date: Wed, 18 Feb 2026 15:03:31 -0500 Subject: [PATCH] dm vdo indexer: validate saved region and zone counts Defer zone_count check until the zone_count has been completely computed. (It can depend on the existence of an empty region in the table.) Also validate the region_count to catch cases where too few regions are defined. Signed-off-by: Matthew Sakai --- drivers/md/dm-vdo/indexer/index-layout.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-vdo/indexer/index-layout.c b/drivers/md/dm-vdo/indexer/index-layout.c index 37144249f7ba..90a2e4b7345c 100644 --- a/drivers/md/dm-vdo/indexer/index-layout.c +++ b/drivers/md/dm-vdo/indexer/index-layout.c @@ -1444,11 +1444,11 @@ static int __must_check reconstruct_index_save(struct index_save_layout *isl, u64 next_block = isl->index_save.start_block; u64 last_block = next_block + isl->index_save.block_count; - isl->zone_count = table->header.region_count - 3; - if (isl->zone_count > MAX_ZONES) + if (table->header.region_count < 4) return vdo_log_error_strerror(UDS_CORRUPT_DATA, - "invalid zone count"); + "invalid region count"); + isl->zone_count = table->header.region_count - 3; last_region = &table->regions[table->header.region_count - 1]; if (last_region->kind == RL_KIND_EMPTY) { isl->free_space = *last_region; @@ -1462,6 +1462,10 @@ static int __must_check reconstruct_index_save(struct index_save_layout *isl, }; } + if (isl->zone_count > MAX_ZONES) + return vdo_log_error_strerror(UDS_CORRUPT_DATA, + "invalid zone count"); + isl->header = table->regions[0]; result = verify_region(&isl->header, next_block++, RL_KIND_HEADER, RL_SOLE_INSTANCE);