diff options
| author | Lu Fengqi <lufq.fnst@cn.fujitsu.com> | 2017-04-20 16:07:57 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2017-04-20 13:35:39 +0200 |
| commit | da76d52947f8e3de30f1c7a09080f3d96d7f8b17 (patch) | |
| tree | 024402edc3c31813a7c335f3230d51ced43eea73 | |
| parent | d5213118a5cb36c0a5bfc14131a36650688a9094 (diff) | |
btrfs-progs: print-tree: add validation to print_chunk
In print_chunk, validate the value of uuid_offset when read the dev_uuid of
stripe.
Was triggered by misc-test/015-dump-super-garbage running indefinetelly.
Issue: #37
Signed-off-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | cmds-inspect-dump-super.c | 1 | ||||
| -rw-r--r-- | print-tree.c | 20 |
2 files changed, 20 insertions, 1 deletions
diff --git a/cmds-inspect-dump-super.c b/cmds-inspect-dump-super.c index b65bd2d9..85307e33 100644 --- a/cmds-inspect-dump-super.c +++ b/cmds-inspect-dump-super.c @@ -68,6 +68,7 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb) return; } write_extent_buffer(buf, sb, 0, sizeof(*sb)); + buf->len = sizeof(*sb); array_size = btrfs_super_sys_array_size(sb); array_ptr = sb->sys_chunk_array; diff --git a/print-tree.c b/print-tree.c index 5af80e87..8352e03d 100644 --- a/print-tree.c +++ b/print-tree.c @@ -199,8 +199,14 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk) { int num_stripes = btrfs_chunk_num_stripes(eb, chunk); int i; + u32 chunk_item_size = btrfs_chunk_item_size(num_stripes); char chunk_flags_str[32] = {0}; + if ((unsigned long)chunk + chunk_item_size > eb->len) { + printf("\t\tchunk item invalid\n"); + return; + } + bg_flags_to_str(btrfs_chunk_type(eb, chunk), chunk_flags_str); printf("\t\tlength %llu owner %llu stripe_len %llu type %s\n", (unsigned long long)btrfs_chunk_length(eb, chunk), @@ -216,9 +222,21 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk) for (i = 0 ; i < num_stripes ; i++) { unsigned char dev_uuid[BTRFS_UUID_SIZE]; char str_dev_uuid[BTRFS_UUID_UNPARSED_SIZE]; + u64 uuid_offset; + u64 stripe_offset; + + uuid_offset = (unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i); + stripe_offset = (unsigned long)btrfs_stripe_nr(chunk, i); + + if (uuid_offset < stripe_offset || + (uuid_offset + BTRFS_UUID_SIZE) > + (stripe_offset + sizeof(struct btrfs_stripe))) { + printf("\t\t\tstripe %d invalid\n", i); + break; + } read_extent_buffer(eb, dev_uuid, - (unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i), + uuid_offset, BTRFS_UUID_SIZE); uuid_unparse(dev_uuid, str_dev_uuid); printf("\t\t\tstripe %d devid %llu offset %llu\n", i, |