RepoMirrors/btrfs-progs
1
0
Fork 0
mirror of https://github.com/kdave/btrfs-progs synced 2025-01-30 01:12:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: print-tree: add validation to print_chunk

Browse Source 
In print_chunk, validate the value of uuid_offset when read the dev_uuid of
stripe.

Was triggered by misc-test/015-dump-super-garbage running indefinetelly.

Issue: #37
Signed-off-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Lu Fengqi 2017-04-20 16:07:57 +08:00 committed by David Sterba
parent d5213118a5
commit da76d52947
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmds-inspect-dump-super.c
View File

@ -68,6 +68,7 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb)
return;
}
write_extent_buffer(buf, sb, 0, sizeof(*sb));
buf->len = sizeof(*sb);
array_size = btrfs_super_sys_array_size(sb);
array_ptr = sb->sys_chunk_array;

20
print-tree.c
View File

@ -199,8 +199,14 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk)
{
int num_stripes = btrfs_chunk_num_stripes(eb, chunk);
int i;
u32 chunk_item_size = btrfs_chunk_item_size(num_stripes);
char chunk_flags_str[32] = {0};
if ((unsigned long)chunk + chunk_item_size > eb->len) {
printf("\t\tchunk item invalid\n");
return;
}
bg_flags_to_str(btrfs_chunk_type(eb, chunk), chunk_flags_str);
printf("\t\tlength %llu owner %llu stripe_len %llu type %s\n",
(unsigned long long)btrfs_chunk_length(eb, chunk),
@ -216,9 +222,21 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk)
for (i = 0 ; i < num_stripes ; i++) {
unsigned char dev_uuid[BTRFS_UUID_SIZE];
char str_dev_uuid[BTRFS_UUID_UNPARSED_SIZE];
u64 uuid_offset;
u64 stripe_offset;
uuid_offset = (unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i);
stripe_offset = (unsigned long)btrfs_stripe_nr(chunk, i);
if (uuid_offset < stripe_offset ||
(uuid_offset + BTRFS_UUID_SIZE) >
(stripe_offset + sizeof(struct btrfs_stripe))) {
printf("\t\t\tstripe %d invalid\n", i);
break;
}
read_extent_buffer(eb, dev_uuid,
(unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i),
uuid_offset,
BTRFS_UUID_SIZE);
uuid_unparse(dev_uuid, str_dev_uuid);
printf("\t\t\tstripe %d devid %llu offset %llu\n", i,