aboutsummaryrefslogtreecommitdiffstats
path: root/disk-io.c
diff options
context:
space:
mode:
authorQu Wenruo <quwenruo@cn.fujitsu.com>2015-05-22 09:01:23 +0800
committerDavid Sterba <dsterba@suse.cz>2015-05-25 14:58:58 +0200
commit6c9e4dacb2467944b306cafe977514fae076f0da (patch)
tree881adf7bf7cf9e819ebf22234bde304d96df331f /disk-io.c
parent9e3e423d688b5c825db83efd9c6ac5aa0355be55 (diff)
downloadbtrfs-progs-6c9e4dacb2467944b306cafe977514fae076f0da.tar.gz
btrfs-progs-6c9e4dacb2467944b306cafe977514fae076f0da.tar.xz
btrfs-progs-6c9e4dacb2467944b306cafe977514fae076f0da.zip
btrfs-progs: Enhance read_tree_block to avoid memory corruption
Add the following tree block check to avoid memory corruption on hostile image: 1) Check level. Level >= BTRFS_MAX_LEVEL won't be read out. 2) Nritems. For nr_items > max_nritems, the tree_block won't be read out. Max nritems is calculated in a easy method. For node, it's straightforward, just (nodesize - header size) / (btrfs_key_ptr) For leaf, (nodesize - header size) / (btrfs_item), as btrfs support zero item size This fixes 3 kernel bugs: BZ#97171, BZ#97191, BZ#97271. Reported-by: Lukas Lueg <lukas.lueg@gmail.com> Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.cz>
Diffstat (limited to 'disk-io.c')
-rw-r--r--disk-io.c26
1 files changed, 26 insertions, 0 deletions
diff --git a/disk-io.c b/disk-io.c
index 2a7feb0..a6e6056 100644
--- a/disk-io.c
+++ b/disk-io.c
@@ -37,6 +37,19 @@
/* specified errno for check_tree_block */
#define BTRFS_BAD_BYTENR (-1)
#define BTRFS_BAD_FSID (-2)
+#define BTRFS_BAD_LEVEL (-3)
+#define BTRFS_BAD_NRITEMS (-4)
+
+/* Calculate max possible nritems for a leaf/node */
+static u32 max_nritems(u8 level, u32 nodesize)
+{
+
+ if (level == 0)
+ return ((nodesize - sizeof(struct btrfs_header)) /
+ sizeof(struct btrfs_item));
+ return ((nodesize - sizeof(struct btrfs_header)) /
+ sizeof(struct btrfs_key_ptr));
+}
static int check_tree_block(struct btrfs_root *root, struct extent_buffer *buf)
{
@@ -46,6 +59,11 @@ static int check_tree_block(struct btrfs_root *root, struct extent_buffer *buf)
if (buf->start != btrfs_header_bytenr(buf))
return BTRFS_BAD_BYTENR;
+ if (btrfs_header_level(buf) >= BTRFS_MAX_LEVEL)
+ return BTRFS_BAD_LEVEL;
+ if (btrfs_header_nritems(buf) > max_nritems(btrfs_header_level(buf),
+ root->nodesize))
+ return BTRFS_BAD_NRITEMS;
fs_devices = root->fs_info->fs_devices;
while (fs_devices) {
@@ -82,6 +100,14 @@ static void print_tree_block_error(struct btrfs_root *root,
fprintf(stderr, "bytenr mismatch, want=%llu, have=%llu\n",
eb->start, btrfs_header_bytenr(eb));
break;
+ case BTRFS_BAD_LEVEL:
+ fprintf(stderr, "bad level, %u > %u\n",
+ btrfs_header_level(eb), BTRFS_MAX_LEVEL);
+ break;
+ case BTRFS_BAD_NRITEMS:
+ fprintf(stderr, "invalid nr_items: %u\n",
+ btrfs_header_nritems(eb));
+ break;
}
}