xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

btrfs: tree-checker: check item_size for dev_item

Browse Source 
commit ea1d1ca4025ac6c075709f549f9aa036b5b6597d upstream.

Check item size before accessing the device item to avoid out of bound
access, similar to inode_item check.

Signed-off-by: Su Yue <l@damenly.su>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Su Yue
2022-01-21 17:33:35 +08:00
committed by Greg Kroah-Hartman
parent 5c967dd073
commit 72a5b01875
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
fs/btrfs/tree-checker.c
View File

@@ -947,6 +947,7 @@ static int check_dev_item(struct extent_buffer *leaf,
struct btrfs_key *key, int slot) struct btrfs_key *key, int slot)
{ {
struct btrfs_dev_item *ditem; struct btrfs_dev_item *ditem;
const u32 item_size = btrfs_item_size_nr(leaf, slot);
if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) { if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) {
dev_item_err(leaf, slot, dev_item_err(leaf, slot,
@@ -954,6 +955,13 @@ static int check_dev_item(struct extent_buffer *leaf,
key->objectid, BTRFS_DEV_ITEMS_OBJECTID); key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
return -EUCLEAN; return -EUCLEAN;
} }
if (unlikely(item_size != sizeof(*ditem))) {
dev_item_err(leaf, slot, "invalid item size: has %u expect %zu",
item_size, sizeof(*ditem));
return -EUCLEAN;
}
ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item); ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
if (btrfs_device_id(leaf, ditem) != key->offset) { if (btrfs_device_id(leaf, ditem) != key->offset) {
dev_item_err(leaf, slot, dev_item_err(leaf, slot,