mirror of
https://github.com/kdave/btrfs-progs
synced 2024-12-27 00:22:22 +00:00
Userspace utilities to manage btrfs filesystems
1a96fa0e6b
When reading out name from inode_ref, it's possible that corrupted name_len can lead to read beyond boundary of item or even extent buffer. This happens when checking fuzzed image /tmp/bko-161811.raw, for both lowmem mode and original mode. Below is the example from lowmem mode. ERROR: root 5 INODE REF[256 256] doesn't have related DIR_INDEX[256 216172782113783808] namelen 255 filename bar filetype 0 ERROR: root 5 INODE REF[256 256] doesn't have related DIR_ITEM[256 1306590535] namelen 255 filename bar filetype 0 WARNING: root 5 INODE[256] mode 0 shouldn't have DIR_INDEX[256 1167283096] WARNING: root 5 DIR_ITEM[256 1167283096] name too long ==13013== Invalid read of size 1 ==13013== at 0x4C31A38: memmove (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13013== by 0x431518: read_extent_buffer (extent_io.c:863) ==13013== by 0x4752AB: check_dir_item (cmds-check.c:4627) ==13013== by 0x475E5C: check_inode_item (cmds-check.c:4911) ==13013== by 0x476200: check_fs_first_inode (cmds-check.c:5011) ==13013== by 0x476276: check_fs_root_v2 (cmds-check.c:5044) ==13013== by 0x4769FB: check_fs_roots_v2 (cmds-check.c:5242) ==13013== by 0x488B5B: cmd_check (cmds-check.c:13033) ==13013== by 0x40A8C5: main (btrfs.c:246) ==13013== Address 0x5c95b80 is 0 bytes after a block of size 4,224 alloc'd ==13013== at 0x4C2CF35: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13013== by 0x4307E0: __alloc_extent_buffer (extent_io.c:538) ==13013== by 0x430C37: alloc_extent_buffer (extent_io.c:642) ==13013== by 0x413DFE: btrfs_find_create_tree_block (disk-io.c:193) ==13013== by 0x414370: read_tree_block_fs_info (disk-io.c:340) ==13013== by 0x40B5D5: read_tree_block (disk-io.h:125) ==13013== by 0x40CFD2: read_node_slot (ctree.c:652) ==13013== by 0x40E5EB: btrfs_search_slot (ctree.c:1172) ==13013== by 0x4761A8: check_fs_first_inode (cmds-check.c:5001) ==13013== by 0x476276: check_fs_root_v2 (cmds-check.c:5044) ==13013== by 0x4769FB: check_fs_roots_v2 (cmds-check.c:5242) ==13013== by 0x488B5B: cmd_check (cmds-check.c:13033) Fix it by double checking dir_item, name_len against item boundary before trying to read out name from extent buffer, for both original mode and lowmem mode. Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.com> |
||
|---|---|---|
| convert | ||
| Documentation | ||
| image | ||
| kernel-lib | ||
| kernel-shared | ||
| m4 | ||
| mkfs | ||
| tests | ||
| .gitignore | ||
| .travis.yml | ||
| 64-btrfs-dm.rules | ||
| Android.mk | ||
| androidcompat.h | ||
| autogen.sh | ||
| backref.c | ||
| backref.h | ||
| bcp | ||
| btrfs-calc-size.c | ||
| btrfs-completion | ||
| btrfs-corrupt-block.c | ||
| btrfs-crc.c | ||
| btrfs-debug-tree.c | ||
| btrfs-debugfs | ||
| btrfs-find-root.c | ||
| btrfs-fragments.c | ||
| btrfs-list.c | ||
| btrfs-list.h | ||
| btrfs-map-logical.c | ||
| btrfs-select-super.c | ||
| btrfs-show-super.c | ||
| btrfs-zero-log.c | ||
| btrfs.c | ||
| btrfsck.h | ||
| btrfstune.c | ||
| CHANGES | ||
| chunk-recover.c | ||
| cmds-balance.c | ||
| cmds-check.c | ||
| cmds-device.c | ||
| cmds-fi-du.c | ||
| cmds-fi-du.h | ||
| cmds-fi-usage.c | ||
| cmds-fi-usage.h | ||
| cmds-filesystem.c | ||
| cmds-inspect-dump-super.c | ||
| cmds-inspect-dump-super.h | ||
| cmds-inspect-dump-tree.c | ||
| cmds-inspect-dump-tree.h | ||
| cmds-inspect-tree-stats.c | ||
| cmds-inspect-tree-stats.h | ||
| cmds-inspect.c | ||
| cmds-property.c | ||
| cmds-qgroup.c | ||
| cmds-quota.c | ||
| cmds-receive.c | ||
| cmds-replace.c | ||
| cmds-rescue.c | ||
| cmds-restore.c | ||
| cmds-scrub.c | ||
| cmds-send.c | ||
| cmds-subvolume.c | ||
| commands.h | ||
| common-defs.h | ||
| configure.ac | ||
| COPYING | ||
| ctree.c | ||
| ctree.h | ||
| dir-item.c | ||
| dir-test.c | ||
| disk-io.c | ||
| disk-io.h | ||
| extent_io.c | ||
| extent_io.h | ||
| extent-cache.c | ||
| extent-cache.h | ||
| extent-tree.c | ||
| file-item.c | ||
| file.c | ||
| find-root.c | ||
| find-root.h | ||
| free-space-cache.c | ||
| free-space-cache.h | ||
| free-space-tree.c | ||
| free-space-tree.h | ||
| fsck.btrfs | ||
| fsfeatures.c | ||
| fsfeatures.h | ||
| hash.h | ||
| hasher.c | ||
| help.c | ||
| help.h | ||
| inode-item.c | ||
| inode-map.c | ||
| inode.c | ||
| INSTALL | ||
| internal.h | ||
| ioctl-test.c | ||
| ioctl.h | ||
| kerncompat.h | ||
| library-test.c | ||
| Makefile | ||
| Makefile.extrawarn | ||
| Makefile.inc.in | ||
| messages.c | ||
| messages.h | ||
| print-tree.c | ||
| print-tree.h | ||
| props.c | ||
| props.h | ||
| qgroup-verify.c | ||
| qgroup-verify.h | ||
| qgroup.c | ||
| qgroup.h | ||
| quick-test.c | ||
| raid56.c | ||
| random-test.c | ||
| rbtree-utils.c | ||
| rbtree-utils.h | ||
| README.md | ||
| repair.c | ||
| repair.h | ||
| root-tree.c | ||
| send-dump.c | ||
| send-dump.h | ||
| send-stream.c | ||
| send-stream.h | ||
| send-utils.c | ||
| send-utils.h | ||
| send.h | ||
| show-blocks | ||
| string-table.c | ||
| string-table.h | ||
| super-recover.c | ||
| task-utils.c | ||
| task-utils.h | ||
| transaction.h | ||
| utils-lib.c | ||
| utils.c | ||
| utils.h | ||
| uuid-tree.c | ||
| version.h.in | ||
| version.sh | ||
| volumes.c | ||
| volumes.h | ||
Btrfs-progs 
Userspace utilities to manage btrfs filesystems. License: GPLv2.
Btrfs is a copy on write (COW) filesystem for Linux aimed at implementing advanced features while focusing on fault tolerance, repair and easy administration.
This repository hosts following utilities:
- btrfs — the main administration tool (manual page)
- mkfs.btrfs — utility to create the filesystem (manual page)
See INSTALL for build instructions and tests/README.md for testing information.
Release cycle
The major version releases are time-based and follow the cycle of the linux kernel releases. The cycle usually takes 2 months. A minor version releases may happen in the meantime if there are bug fixes or minor useful improvements queued.
The release tags are signed with a GPG key ID F2B4 1200 C54E FB30 380C 1756 C565 D5F9 D76D 583B,
release tarballs are hosted at kernel.org.
See file CHANGES or changelogs on wiki.
Reporting bugs
There are several ways, each has its own specifics and audience that can give feedback or work on a fix. The following list is sorted in the order of preference:
- github issue tracker
- to the mailing list linux-btrfs@vger.kernel.org -- (not required to subscribe), beware that the mail might get overlooked in other traffic
- IRC (irc.freenode.net #btrfs) -- good for discussions eg. if a bug is already known, but reports could miss developers' attention
- bugzilla.kernel.org -- (requires registration), set the product to Filesystems and component Btrfs, please put 'btrfs-progs' into the subject so it's clear that it's not a kernel bug report
Development
The patch submissions, development or general discussions take place at linux-btrfs@vger.kernel.org mailinglist, subsciption is not required to post.
The GitHub pull requests will not be accepted directly, the preferred way is to send patches to the mailinglist instead. You can link to a branch in any git repository if the mails do not make it to the mailinglist or just for convenience (makes it easier to test).
The development model of btrfs-progs shares a lot with the kernel model. The github way is different in some ways. We, the upstream community, expect that the patches meet some criteria (often lacking in github contributions):
- one logical change per patch: eg. not mixing bugfixes, cleanups, features etc., sometimes it's not clear and will be usually pointed out during reviews
- proper subject line: eg. prefix with btrfs-progs: subpart, ... ,
descriptive yet not too long, see
git log --onelinefor some inspiration - proper changelog: the changelogs are often missing or lacking explanation why the change was made, or how is something broken, what are user-visible effects of the bug or the fix, how does an improvement help or the intended usecase
- the Signed-off-by line: this documents who authored the change, you can read more about the The Developer's Certificate of Origin here (chapter 11)
Documentation updates
Documentation fixes or updates do not need much explanation so sticking to the code rules in the previous section is not necessary. Github pull requests are OK, patches could be sent to me directly and not required to be also in the mailinglist. Pointing out typos via IRC also works, although might get accidentally lost in the noise.