diff options
author | Qu Wenruo <quwenruo@cn.fujitsu.com> | 2015-05-22 09:01:23 +0800 |
---|---|---|
committer | David Sterba <dsterba@suse.cz> | 2015-05-25 14:58:58 +0200 |
commit | 6c9e4dacb2467944b306cafe977514fae076f0da (patch) | |
tree | 881adf7bf7cf9e819ebf22234bde304d96df331f /disk-io.c | |
parent | 9e3e423d688b5c825db83efd9c6ac5aa0355be55 (diff) |
btrfs-progs: Enhance read_tree_block to avoid memory corruption
Add the following tree block check to avoid memory corruption on hostile
image:
1) Check level.
Level >= BTRFS_MAX_LEVEL won't be read out.
2) Nritems.
For nr_items > max_nritems, the tree_block won't be read out.
Max nritems is calculated in a easy method.
For node, it's straightforward, just (nodesize - header size) /
(btrfs_key_ptr)
For leaf, (nodesize - header size) / (btrfs_item), as btrfs support zero
item size
This fixes 3 kernel bugs: BZ#97171, BZ#97191, BZ#97271.
Reported-by: Lukas Lueg <lukas.lueg@gmail.com>
Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Diffstat (limited to 'disk-io.c')
-rw-r--r-- | disk-io.c | 26 |
1 files changed, 26 insertions, 0 deletions
@@ -37,6 +37,19 @@ /* specified errno for check_tree_block */ #define BTRFS_BAD_BYTENR (-1) #define BTRFS_BAD_FSID (-2) +#define BTRFS_BAD_LEVEL (-3) +#define BTRFS_BAD_NRITEMS (-4) + +/* Calculate max possible nritems for a leaf/node */ +static u32 max_nritems(u8 level, u32 nodesize) +{ + + if (level == 0) + return ((nodesize - sizeof(struct btrfs_header)) / + sizeof(struct btrfs_item)); + return ((nodesize - sizeof(struct btrfs_header)) / + sizeof(struct btrfs_key_ptr)); +} static int check_tree_block(struct btrfs_root *root, struct extent_buffer *buf) { @@ -46,6 +59,11 @@ static int check_tree_block(struct btrfs_root *root, struct extent_buffer *buf) if (buf->start != btrfs_header_bytenr(buf)) return BTRFS_BAD_BYTENR; + if (btrfs_header_level(buf) >= BTRFS_MAX_LEVEL) + return BTRFS_BAD_LEVEL; + if (btrfs_header_nritems(buf) > max_nritems(btrfs_header_level(buf), + root->nodesize)) + return BTRFS_BAD_NRITEMS; fs_devices = root->fs_info->fs_devices; while (fs_devices) { @@ -82,6 +100,14 @@ static void print_tree_block_error(struct btrfs_root *root, fprintf(stderr, "bytenr mismatch, want=%llu, have=%llu\n", eb->start, btrfs_header_bytenr(eb)); break; + case BTRFS_BAD_LEVEL: + fprintf(stderr, "bad level, %u > %u\n", + btrfs_header_level(eb), BTRFS_MAX_LEVEL); + break; + case BTRFS_BAD_NRITEMS: + fprintf(stderr, "invalid nr_items: %u\n", + btrfs_header_nritems(eb)); + break; } } |