RepoMirrors
/
btrfs-progs
mirror of https://github.com/kdave/btrfs-progs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: more sanity checks in read_tree_block_fs_info 

If blocksize is 0, it passes the IS_ALIGNED check but fails later as the
length of ebs will be zero.

Reported-by: Lukas Lueg <lukas.lueg@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169311
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
David Sterba 2016-09-30 16:19:20 +02:00
parent 14de259f1f
commit 6cca2ea9be
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
disk-io.c
View File

@ -326,16 +326,17 @@ struct extent_buffer* read_tree_block_fs_info(
* Such unaligned tree block will free overlapping extent buffer, * Such unaligned tree block will free overlapping extent buffer,
* causing use-after-free bugs for fuzzed images. * causing use-after-free bugs for fuzzed images.
*/ */
if (!IS_ALIGNED(bytenr, sectorsize)) { if (bytenr < sectorsize || !IS_ALIGNED(bytenr, sectorsize)) {
error("tree block bytenr %llu is not aligned to sectorsize %u", error("tree block bytenr %llu is not aligned to sectorsize %u",
bytenr, sectorsize); bytenr, sectorsize);
return ERR_PTR(-EIO); return ERR_PTR(-EIO);
} }
if (!IS_ALIGNED(blocksize, nodesize)) { if (blocksize < nodesize || !IS_ALIGNED(blocksize, nodesize)) {
error("tree block size %u is not aligned to nodesize %u", error("tree block size %u is not aligned to nodesize %u",
blocksize, nodesize); blocksize, nodesize);
return ERR_PTR(-EIO); return ERR_PTR(-EIO);
} }
eb = btrfs_find_create_tree_block(fs_info, bytenr, blocksize); eb = btrfs_find_create_tree_block(fs_info, bytenr, blocksize);
if (!eb) if (!eb)
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);