1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
URL: https://bugzilla.kernel.org/show_bug.cgi?id=97271
Lukas Lueg 2015-04-25 20:34:39 UTC
The attached btrfs-image causes "btrfs check" to write outside of allocated
memory locations and ultimately die due to a segfault. An adjacent heap block's
control structure is overwritten with a `struct extent_buffer *`, which is not
controllable by the user.
"btrfs version" is v3.19.1. Running "btrfs check" immediately dies with
*** Error in `btrfs': double free or corruption (!prev): 0x0000000002396ec0 ***
*** Error in `btrfs': malloc(): memory corruption: 0x0000000002396f60 ***
Debugging with valgrind and gdb gives
==11670== Invalid write of size 8
==11670== at 0x4386FB: btrfs_search_slot (ctree.c:1119)
==11670== by 0x44E16E: btrfs_read_chunk_tree (volumes.c:1814)
==11670== by 0x43D654: btrfs_setup_chunk_tree_and_device_map (disk-io.c:1115)
==11670== by 0x43D7D0: __open_ctree_fd (disk-io.c:1190)
==11670== by 0x43D964: open_ctree_fs_info (disk-io.c:1231)
==11670== by 0x427BF4: cmd_check (cmds-check.c:9326)
==11670== by 0x40E5A1: main (btrfs.c:245)
==11670== Address 0x4c3bb98 is 8 bytes after a block of size 144 alloc'd
==11670== at 0x4A08946: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11670== by 0x44E133: btrfs_read_chunk_tree (volumes.c:1801)
==11670== by 0x43D654: btrfs_setup_chunk_tree_and_device_map (disk-io.c:1115)
==11670== by 0x43D7D0: __open_ctree_fd (disk-io.c:1190)
==11670== by 0x43D964: open_ctree_fs_info (disk-io.c:1231)
==11670== by 0x427BF4: cmd_check (cmds-check.c:9326)
==11670== by 0x40E5A1: main (btrfs.c:245)
Program received signal SIGTRAP, Trace/breakpoint trap.
btrfs_search_slot (trans=trans@entry=0x0, root=root@entry=0x4c36d30, key=key@entry=0xffefff830, p=p@entry=0x4c3bb00,
ins_len=ins_len@entry=0, cow=cow@entry=0) at ctree.c:1119
1119 p->nodes[level] = b;
(gdb) p p->nodes
$1 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}
(gdb) p p
$2 = (struct btrfs_path *) 0x4c3bb00
(gdb) p b
$3 = (struct extent_buffer *) 0x4c3a990
The corresponding part in ctree.c:btrfs_search_slot() seems to fail to check if `level` overflows outside of `node`:
level = btrfs_header_level(b);
...
if (level != btrfs_header_level(b))
WARN_ON(1);
level = btrfs_header_level(b);
p->nodes[level] = b; // <- Illegal write
Maybe the repeated calls to btrfs_header_level() were meant to do something once, they seem to be noise.
|
