mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
btrfs: more superblock checks, lower bounds on devices and sectorsize/nodesize
I received a few crafted images from Jiri, all got through the recently added superblock checks. The lower bounds checks for num_devices and sector/node -sizes were missing and caused a crash during mount. Tools for symbolic code execution were used to prepare the images contents. Reported-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
parent
9cc97d6462
commit
75d6ad382b
1 changed files with 19 additions and 0 deletions
|
@ -3871,6 +3871,21 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
|
||||||
printk(KERN_WARNING "BTRFS: log_root block unaligned: %llu\n",
|
printk(KERN_WARNING "BTRFS: log_root block unaligned: %llu\n",
|
||||||
btrfs_super_log_root(sb));
|
btrfs_super_log_root(sb));
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Check the lower bound, the alignment and other constraints are
|
||||||
|
* checked later.
|
||||||
|
*/
|
||||||
|
if (btrfs_super_nodesize(sb) < 4096) {
|
||||||
|
printk(KERN_ERR "BTRFS: nodesize too small: %u < 4096\n",
|
||||||
|
btrfs_super_nodesize(sb));
|
||||||
|
ret = -EINVAL;
|
||||||
|
}
|
||||||
|
if (btrfs_super_sectorsize(sb) < 4096) {
|
||||||
|
printk(KERN_ERR "BTRFS: sectorsize too small: %u < 4096\n",
|
||||||
|
btrfs_super_sectorsize(sb));
|
||||||
|
ret = -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if (memcmp(fs_info->fsid, sb->dev_item.fsid, BTRFS_UUID_SIZE) != 0) {
|
if (memcmp(fs_info->fsid, sb->dev_item.fsid, BTRFS_UUID_SIZE) != 0) {
|
||||||
printk(KERN_ERR "BTRFS: dev_item UUID does not match fsid: %pU != %pU\n",
|
printk(KERN_ERR "BTRFS: dev_item UUID does not match fsid: %pU != %pU\n",
|
||||||
fs_info->fsid, sb->dev_item.fsid);
|
fs_info->fsid, sb->dev_item.fsid);
|
||||||
|
@ -3884,6 +3899,10 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
|
||||||
if (btrfs_super_num_devices(sb) > (1UL << 31))
|
if (btrfs_super_num_devices(sb) > (1UL << 31))
|
||||||
printk(KERN_WARNING "BTRFS: suspicious number of devices: %llu\n",
|
printk(KERN_WARNING "BTRFS: suspicious number of devices: %llu\n",
|
||||||
btrfs_super_num_devices(sb));
|
btrfs_super_num_devices(sb));
|
||||||
|
if (btrfs_super_num_devices(sb) == 0) {
|
||||||
|
printk(KERN_ERR "BTRFS: number of devices is 0\n");
|
||||||
|
ret = -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if (btrfs_super_bytenr(sb) != BTRFS_SUPER_INFO_OFFSET) {
|
if (btrfs_super_bytenr(sb) != BTRFS_SUPER_INFO_OFFSET) {
|
||||||
printk(KERN_ERR "BTRFS: super offset mismatch %llu != %u\n",
|
printk(KERN_ERR "BTRFS: super offset mismatch %llu != %u\n",
|
||||||
|
|
Loading…
Reference in a new issue