btrfs: tree-checker: Check item size before reading file extent type
diff mbox series

Message ID
State New
Headers show
  • btrfs: tree-checker: Check item size before reading file extent type
Related show

Commit Message

Qu Wenruo Sept. 2, 2019, 11:46 p.m. UTC
In check_extent_data_item(), we read file extent type without verifying
if the item size is valid.

Add such check to ensure the file extent type we read is correct.

The check is not as accurate as we need to cover both inline and regular
extents, so it only checks if the item size is larger or equal to inline
So the existing size checks on inline/regular extents are still needed.

Signed-off-by: Qu Wenruo <>
 fs/btrfs/tree-checker.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff mbox series

diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index 15d1aa7cef1f..22e6474f9d4e 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -143,6 +143,17 @@  static int check_extent_data_item(struct extent_buffer *leaf,
 	fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
+	/*
+	 * Make sure the item contains at least inline header, so the file
+	 * extent type is not some garbage.
+	 */
+		file_extent_err(leaf, slot,
+		"invalid item size, have %u expect [%lu, %u)",
+				SZ_4K);
+		return -EUCLEAN;
+	}
 	if (btrfs_file_extent_type(leaf, fi) > BTRFS_FILE_EXTENT_TYPES) {
 		file_extent_err(leaf, slot,
 		"invalid type for file extent, have %u expect range [0, %u]",