| Message ID | 1429837961-2255-2-git-send-email-quwenruo@cn.fujitsu.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, Apr 24, 2015 at 09:12:41AM +0800, Qu Wenruo wrote: > Although only RAID10 use sub_stripes, a hostile attack can modify chunk > tree and just add RAID10 bit to a single chunk. > Then btrfs_map_block will trigger a 0 division in kernel and destroy > everything. > > Just add extra check when reading chunk from disk. > > Reported-by: Lukas Lueg <lukas.lueg@gmail.com> > Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> Reviewed-by: David Sterba <dsterba@suse.cz> -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 8222f6f..fdcecf7 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6061,6 +6061,17 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, map->stripe_len = btrfs_chunk_stripe_len(leaf, chunk); map->type = btrfs_chunk_type(leaf, chunk); map->sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk); + + /* Add extra check to avoid hostile 0 division attack */ + if (map->type & BTRFS_BLOCK_GROUP_RAID10 && + map->sub_stripes == 0) { + btrfs_warn(root->fs_info, + "RAID10 chunk found but with no sub stripe for bytenr: %llu\n", + logical); + free_extent_map(em); + return -EIO; + } + for (i = 0; i < num_stripes; i++) { map->stripes[i].physical = btrfs_stripe_offset_nr(leaf, chunk, i);
Although only RAID10 use sub_stripes, a hostile attack can modify chunk tree and just add RAID10 bit to a single chunk. Then btrfs_map_block will trigger a 0 division in kernel and destroy everything. Just add extra check when reading chunk from disk. Reported-by: Lukas Lueg <lukas.lueg@gmail.com> Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com> --- v2: Return -EIO, and add kernel message output. --- fs/btrfs/volumes.c | 11 +++++++++++ 1 file changed, 11 insertions(+)