diff options
| author | David Sterba <dsterba@suse.com> | 2016-09-30 16:19:20 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2016-10-03 15:07:24 +0200 |
| commit | 6cca2ea9bea9137fba30b48242868e3d757906dc (patch) | |
| tree | 41aaa65958f4a1ba6a225417dc6e794abb1e8ba4 /disk-io.c | |
| parent | 14de259f1f434a1d4d321ebebb28f95f3c9f71d8 (diff) | |
btrfs-progs: more sanity checks in read_tree_block_fs_info
If blocksize is 0, it passes the IS_ALIGNED check but fails later as the
length of ebs will be zero.
Reported-by: Lukas Lueg <lukas.lueg@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169311
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'disk-io.c')
| -rw-r--r-- | disk-io.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -326,16 +326,17 @@ struct extent_buffer* read_tree_block_fs_info( * Such unaligned tree block will free overlapping extent buffer, * causing use-after-free bugs for fuzzed images. */ - if (!IS_ALIGNED(bytenr, sectorsize)) { + if (bytenr < sectorsize || !IS_ALIGNED(bytenr, sectorsize)) { error("tree block bytenr %llu is not aligned to sectorsize %u", bytenr, sectorsize); return ERR_PTR(-EIO); } - if (!IS_ALIGNED(blocksize, nodesize)) { + if (blocksize < nodesize || !IS_ALIGNED(blocksize, nodesize)) { error("tree block size %u is not aligned to nodesize %u", blocksize, nodesize); return ERR_PTR(-EIO); } + eb = btrfs_find_create_tree_block(fs_info, bytenr, blocksize); if (!eb) return ERR_PTR(-ENOMEM); |