From patchwork Tue Sep 9 09:19:36 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: li rongqing X-Patchwork-Id: 4867091 Return-Path: X-Original-To: patchwork-linux-btrfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 378589F3EC for ; Tue, 9 Sep 2014 09:19:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 9BF0F20145 for ; Tue, 9 Sep 2014 09:19:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4BB8120035 for ; Tue, 9 Sep 2014 09:19:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755200AbaIIJTe (ORCPT ); Tue, 9 Sep 2014 05:19:34 -0400 Received: from mail.windriver.com ([147.11.1.11]:53279 "EHLO mail.windriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754494AbaIIJTd (ORCPT ); Tue, 9 Sep 2014 05:19:33 -0400 Received: from ALA-HCA.corp.ad.wrs.com (ala-hca.corp.ad.wrs.com [147.11.189.40]) by mail.windriver.com (8.14.9/8.14.5) with ESMTP id s899JXcp023053 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 9 Sep 2014 02:19:33 -0700 (PDT) Received: from lirq-OptiPlex-780.corp.ad.wrs.com (128.224.162.141) by ALA-HCA.corp.ad.wrs.com (147.11.189.40) with Microsoft SMTP Server id 14.3.174.1; Tue, 9 Sep 2014 02:19:32 -0700 From: To: Subject: [PATCH] btrfs: fix a overflowing boundary writing in csum_tree_block Date: Tue, 9 Sep 2014 17:19:36 +0800 Message-ID: <1410254376-6357-1-git-send-email-rongqing.li@windriver.com> X-Mailer: git-send-email 1.7.10.4 MIME-Version: 1.0 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Spam-Status: No, score=-9.4 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Li RongQing It is impossible that csum_size is larger than sizeof(long), but the codes still add the handler for this condition, like allocate new memory, for extension. If it becomes true someday, copying csum_size size memory to local 32bit variable found and val will overflow these two variables. Fix it by returning the max 4 byte checksum. Signed-off-by: Li RongQing --- fs/btrfs/disk-io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index ce8b8b6..cfa2953 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -296,6 +296,8 @@ static int csum_tree_block(struct btrfs_root *root, struct extent_buffer *buf, if (memcmp_extent_buffer(buf, result, 0, csum_size)) { u32 val; u32 found = 0; + + csum_size = min_t(u16, csum_size, sizeof(u32)); memcpy(&found, result, csum_size); read_extent_buffer(buf, &val, 0, csum_size);