From patchwork Thu Apr 20 08:07:57 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lu Fengqi X-Patchwork-Id: 9689831 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1EC5160326 for ; Thu, 20 Apr 2017 08:10:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0FB882845C for ; Thu, 20 Apr 2017 08:10:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 04AB428464; Thu, 20 Apr 2017 08:10:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 825952845C for ; Thu, 20 Apr 2017 08:10:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S943436AbdDTIKR (ORCPT ); Thu, 20 Apr 2017 04:10:17 -0400 Received: from cn.fujitsu.com ([59.151.112.132]:61010 "EHLO heian.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S943411AbdDTIIE (ORCPT ); Thu, 20 Apr 2017 04:08:04 -0400 X-IronPort-AV: E=Sophos;i="5.22,518,1449504000"; d="scan'208";a="17967513" Received: from unknown (HELO cn.fujitsu.com) ([10.167.33.5]) by heian.cn.fujitsu.com with ESMTP; 20 Apr 2017 16:08:03 +0800 Received: from G08CNEXCHPEKD01.g08.fujitsu.local (unknown [10.167.33.80]) by cn.fujitsu.com (Postfix) with ESMTP id 5F40547DDB77; Thu, 20 Apr 2017 16:08:02 +0800 (CST) Received: from lufq.5F.5F (10.167.225.63) by G08CNEXCHPEKD01.g08.fujitsu.local (10.167.33.89) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 20 Apr 2017 16:08:01 +0800 From: Lu Fengqi To: CC: Subject: [PATCH v2 2/2] btrfs-progs: print-tree: add validation to print_chunk Date: Thu, 20 Apr 2017 16:07:57 +0800 Message-ID: <20170420080757.1895-2-lufq.fnst@cn.fujitsu.com> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170420080757.1895-1-lufq.fnst@cn.fujitsu.com> References: <20170420080757.1895-1-lufq.fnst@cn.fujitsu.com> MIME-Version: 1.0 X-Originating-IP: [10.167.225.63] X-yoursite-MailScanner-ID: 5F40547DDB77.AE465 X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: lufq.fnst@cn.fujitsu.com Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In print_chunk, validate the value of uuid_offset when read the dev_uuid of stripe. Signed-off-by: Lu Fengqi --- cmds-inspect-dump-super.c | 1 + print-tree.c | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/cmds-inspect-dump-super.c b/cmds-inspect-dump-super.c index b65bd2d9..85307e33 100644 --- a/cmds-inspect-dump-super.c +++ b/cmds-inspect-dump-super.c @@ -68,6 +68,7 @@ static void print_sys_chunk_array(struct btrfs_super_block *sb) return; } write_extent_buffer(buf, sb, 0, sizeof(*sb)); + buf->len = sizeof(*sb); array_size = btrfs_super_sys_array_size(sb); array_ptr = sb->sys_chunk_array; diff --git a/print-tree.c b/print-tree.c index 5af80e87..8352e03d 100644 --- a/print-tree.c +++ b/print-tree.c @@ -199,8 +199,14 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk) { int num_stripes = btrfs_chunk_num_stripes(eb, chunk); int i; + u32 chunk_item_size = btrfs_chunk_item_size(num_stripes); char chunk_flags_str[32] = {0}; + if ((unsigned long)chunk + chunk_item_size > eb->len) { + printf("\t\tchunk item invalid\n"); + return; + } + bg_flags_to_str(btrfs_chunk_type(eb, chunk), chunk_flags_str); printf("\t\tlength %llu owner %llu stripe_len %llu type %s\n", (unsigned long long)btrfs_chunk_length(eb, chunk), @@ -216,9 +222,21 @@ void print_chunk(struct extent_buffer *eb, struct btrfs_chunk *chunk) for (i = 0 ; i < num_stripes ; i++) { unsigned char dev_uuid[BTRFS_UUID_SIZE]; char str_dev_uuid[BTRFS_UUID_UNPARSED_SIZE]; + u64 uuid_offset; + u64 stripe_offset; + + uuid_offset = (unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i); + stripe_offset = (unsigned long)btrfs_stripe_nr(chunk, i); + + if (uuid_offset < stripe_offset || + (uuid_offset + BTRFS_UUID_SIZE) > + (stripe_offset + sizeof(struct btrfs_stripe))) { + printf("\t\t\tstripe %d invalid\n", i); + break; + } read_extent_buffer(eb, dev_uuid, - (unsigned long)btrfs_stripe_dev_uuid_nr(chunk, i), + uuid_offset, BTRFS_UUID_SIZE); uuid_unparse(dev_uuid, str_dev_uuid); printf("\t\t\tstripe %d devid %llu offset %llu\n", i,