mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
![Qu Wenruo](/assets/img/avatar_default.png)
[BUG] Kernel panic when mounting with "-o compress" mount option. KASAN will report like: ------ ================================================================== BUG: KASAN: wild-memory-access in strncmp+0x31/0xc0 Read of size 1 at addr d86735fce994f800 by task mount/662 ... Call Trace: dump_stack+0xe3/0x175 kasan_report+0x163/0x370 __asan_load1+0x47/0x50 strncmp+0x31/0xc0 btrfs_compress_str2level+0x20/0x70 [btrfs] btrfs_parse_options+0xff4/0x1870 [btrfs] open_ctree+0x2679/0x49f0 [btrfs] btrfs_mount+0x1b7f/0x1d30 [btrfs] mount_fs+0x49/0x190 vfs_kern_mount.part.29+0xba/0x280 vfs_kern_mount+0x13/0x20 btrfs_mount+0x31e/0x1d30 [btrfs] mount_fs+0x49/0x190 vfs_kern_mount.part.29+0xba/0x280 do_mount+0xaad/0x1a00 SyS_mount+0x98/0xe0 entry_SYSCALL_64_fastpath+0x1f/0xbe ------ [Cause] For 'compress' and 'compress_force' options, its token doesn't expect any parameter so its args[0] contains uninitialized data. Accessing args[0] will cause above wild memory access. [Fix] For Opt_compress and Opt_compress_force, set compression level to the default. Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> [ set the default in advance ] Signed-off-by: David Sterba <dsterba@suse.com>
142 lines
4.3 KiB
C
142 lines
4.3 KiB
C
/*
|
|
* Copyright (C) 2008 Oracle. All rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public
|
|
* License v2 as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public
|
|
* License along with this program; if not, write to the
|
|
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
|
|
* Boston, MA 021110-1307, USA.
|
|
*/
|
|
|
|
#ifndef __BTRFS_COMPRESSION_
|
|
#define __BTRFS_COMPRESSION_
|
|
|
|
/*
|
|
* We want to make sure that amount of RAM required to uncompress an extent is
|
|
* reasonable, so we limit the total size in ram of a compressed extent to
|
|
* 128k. This is a crucial number because it also controls how easily we can
|
|
* spread reads across cpus for decompression.
|
|
*
|
|
* We also want to make sure the amount of IO required to do a random read is
|
|
* reasonably small, so we limit the size of a compressed extent to 128k.
|
|
*/
|
|
|
|
/* Maximum length of compressed data stored on disk */
|
|
#define BTRFS_MAX_COMPRESSED (SZ_128K)
|
|
/* Maximum size of data before compression */
|
|
#define BTRFS_MAX_UNCOMPRESSED (SZ_128K)
|
|
|
|
#define BTRFS_ZLIB_DEFAULT_LEVEL 3
|
|
|
|
struct compressed_bio {
|
|
/* number of bios pending for this compressed extent */
|
|
refcount_t pending_bios;
|
|
|
|
/* the pages with the compressed data on them */
|
|
struct page **compressed_pages;
|
|
|
|
/* inode that owns this data */
|
|
struct inode *inode;
|
|
|
|
/* starting offset in the inode for our pages */
|
|
u64 start;
|
|
|
|
/* number of bytes in the inode we're working on */
|
|
unsigned long len;
|
|
|
|
/* number of bytes on disk */
|
|
unsigned long compressed_len;
|
|
|
|
/* the compression algorithm for this bio */
|
|
int compress_type;
|
|
|
|
/* number of compressed pages in the array */
|
|
unsigned long nr_pages;
|
|
|
|
/* IO errors */
|
|
int errors;
|
|
int mirror_num;
|
|
|
|
/* for reads, this is the bio we are copying the data into */
|
|
struct bio *orig_bio;
|
|
|
|
/*
|
|
* the start of a variable length array of checksums only
|
|
* used by reads
|
|
*/
|
|
u32 sums;
|
|
};
|
|
|
|
void btrfs_init_compress(void);
|
|
void btrfs_exit_compress(void);
|
|
|
|
int btrfs_compress_pages(unsigned int type_level, struct address_space *mapping,
|
|
u64 start, struct page **pages,
|
|
unsigned long *out_pages,
|
|
unsigned long *total_in,
|
|
unsigned long *total_out);
|
|
int btrfs_decompress(int type, unsigned char *data_in, struct page *dest_page,
|
|
unsigned long start_byte, size_t srclen, size_t destlen);
|
|
int btrfs_decompress_buf2page(const char *buf, unsigned long buf_start,
|
|
unsigned long total_out, u64 disk_start,
|
|
struct bio *bio);
|
|
|
|
blk_status_t btrfs_submit_compressed_write(struct inode *inode, u64 start,
|
|
unsigned long len, u64 disk_start,
|
|
unsigned long compressed_len,
|
|
struct page **compressed_pages,
|
|
unsigned long nr_pages,
|
|
unsigned int write_flags);
|
|
blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
|
|
int mirror_num, unsigned long bio_flags);
|
|
|
|
unsigned btrfs_compress_str2level(const char *str);
|
|
|
|
enum btrfs_compression_type {
|
|
BTRFS_COMPRESS_NONE = 0,
|
|
BTRFS_COMPRESS_ZLIB = 1,
|
|
BTRFS_COMPRESS_LZO = 2,
|
|
BTRFS_COMPRESS_ZSTD = 3,
|
|
BTRFS_COMPRESS_TYPES = 3,
|
|
};
|
|
|
|
struct btrfs_compress_op {
|
|
struct list_head *(*alloc_workspace)(void);
|
|
|
|
void (*free_workspace)(struct list_head *workspace);
|
|
|
|
int (*compress_pages)(struct list_head *workspace,
|
|
struct address_space *mapping,
|
|
u64 start,
|
|
struct page **pages,
|
|
unsigned long *out_pages,
|
|
unsigned long *total_in,
|
|
unsigned long *total_out);
|
|
|
|
int (*decompress_bio)(struct list_head *workspace,
|
|
struct compressed_bio *cb);
|
|
|
|
int (*decompress)(struct list_head *workspace,
|
|
unsigned char *data_in,
|
|
struct page *dest_page,
|
|
unsigned long start_byte,
|
|
size_t srclen, size_t destlen);
|
|
|
|
void (*set_level)(struct list_head *ws, unsigned int type);
|
|
};
|
|
|
|
extern const struct btrfs_compress_op btrfs_zlib_compress;
|
|
extern const struct btrfs_compress_op btrfs_lzo_compress;
|
|
extern const struct btrfs_compress_op btrfs_zstd_compress;
|
|
|
|
int btrfs_compress_heuristic(struct inode *inode, u64 start, u64 end);
|
|
|
|
#endif
|