From patchwork Wed Nov 1 12:14:49 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qu Wenruo X-Patchwork-Id: 10036285 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E5853600C5 for ; Wed, 1 Nov 2017 12:15:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CFA02286BB for ; Wed, 1 Nov 2017 12:15:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C23E728B63; Wed, 1 Nov 2017 12:15:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 02A0B286BB for ; Wed, 1 Nov 2017 12:15:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932995AbdKAMPC (ORCPT ); Wed, 1 Nov 2017 08:15:02 -0400 Received: from prv3-mh.provo.novell.com ([137.65.250.26]:56460 "EHLO prv3-mh.provo.novell.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932972AbdKAMPC (ORCPT ); Wed, 1 Nov 2017 08:15:02 -0400 Received: from adam-pc.lan (prv-ext-foundry1int.gns.novell.com [137.65.251.240]) by prv3-mh.provo.novell.com with ESMTP (NOT encrypted); Wed, 01 Nov 2017 06:14:54 -0600 From: Qu Wenruo To: linux-btrfs@vger.kernel.org Cc: dsterba@suse.cz Subject: [PATCH 1/2] btrfs: tree-checker: Add checker for variable length item Date: Wed, 1 Nov 2017 20:14:49 +0800 Message-Id: <20171101121450.6297-1-wqu@suse.com> X-Mailer: git-send-email 2.14.3 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP For the following types, we have items with variable length: (With BTRFS_ prefix and _KEY suffix snipped) DIR_ITEM DIR_INDEX XATTR_ITEM INODE_REF INODE_EXTREF ROOT_REF ROOT_BACKREF They all use @name_len to indicate their name length, and XATTR_ITEM has extra @data_len to indicate it data length. Despite their variable length, it's also possible to have several such structure inside one item. This patch will add checker to ensure: 1) No structure header and its data cross item boundary 2) Except XATTR_ITEM, no structure should have non-zero @data_len This checker is especially useful to avoid possible access beyond boundary for fuzzed image. Signed-off-by: Qu Wenruo --- fs/btrfs/tree-checker.c | 123 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c index 114fc5f0ecc5..f26e86fcbd74 100644 --- a/fs/btrfs/tree-checker.c +++ b/fs/btrfs/tree-checker.c @@ -222,6 +222,120 @@ static int check_csum_item(struct btrfs_root *root, struct extent_buffer *leaf, return 0; } +static u32 get_header_size(u8 type) +{ + switch (type) { + case BTRFS_DIR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: + case BTRFS_XATTR_ITEM_KEY: + return sizeof(struct btrfs_dir_item); + case BTRFS_INODE_REF_KEY: + return sizeof(struct btrfs_inode_ref); + case BTRFS_INODE_EXTREF_KEY: + return sizeof(struct btrfs_inode_extref); + case BTRFS_ROOT_REF_KEY: + case BTRFS_ROOT_BACKREF_KEY: + return sizeof(struct btrfs_root_ref); + } + WARN_ON(1); + return 0; +} + +static u16 get_header_namelen(struct extent_buffer *leaf, u8 type, + u32 header_offset) +{ + /* + * @header_offset is offset starts after leaf header, while the + * accessors expects offset starts from leaf header. + * Sowe need to adds LEAF_DATA_OFFSET here + */ + unsigned long leaf_offset = header_offset + BTRFS_LEAF_DATA_OFFSET; + + switch (type) { + case BTRFS_DIR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: + case BTRFS_XATTR_ITEM_KEY: + return btrfs_dir_name_len(leaf, (void *)leaf_offset); + case BTRFS_INODE_REF_KEY: + return btrfs_inode_ref_name_len(leaf, (void *)leaf_offset); + case BTRFS_INODE_EXTREF_KEY: + return btrfs_inode_extref_name_len(leaf, (void *)leaf_offset); + case BTRFS_ROOT_REF_KEY: + case BTRFS_ROOT_BACKREF_KEY: + return btrfs_root_ref_name_len(leaf, (void *)leaf_offset); + } + WARN_ON(1); + return 0; +} + +static u16 get_header_datalen(struct extent_buffer *leaf, u8 type, + unsigned long header_offset) +{ + /* Same as get_header_namelen */ + unsigned long leaf_offset = header_offset + BTRFS_LEAF_DATA_OFFSET; + + switch (type) { + case BTRFS_DIR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: + case BTRFS_XATTR_ITEM_KEY: + return btrfs_dir_data_len(leaf, (void *)leaf_offset); + } + return 0; +} + +/* + * For items with variable length, normally with namelen and tailing data. + * Like INODE_REF or XATTR + */ +static int check_variable_length_item(struct btrfs_root *root, + struct extent_buffer *leaf, + struct btrfs_key *key, int slot) +{ + u8 type = key->type; + u32 item_start = btrfs_item_offset_nr(leaf, slot); + u32 item_end = btrfs_item_end_nr(leaf, slot); + u32 header_size = get_header_size(type); + u32 total_size; + u32 cur = item_start; + + while (cur < item_end) { + u32 namelen; + u32 datalen; + + /* header itself should not cross item boundary */ + if (cur + header_size > item_end) { + generic_err(root, leaf, slot, + "structure header crosses item boundary, have %u expect (%u, %u]", + cur + header_size, cur, item_end); + return -EUCLEAN; + } + + namelen = get_header_namelen(leaf, type, cur); + datalen = get_header_datalen(leaf, type, cur); + + /* Only XATTR can own data */ + if (type != BTRFS_XATTR_ITEM_KEY && datalen) { + generic_err(root, leaf, slot, + "item has invalid data len, have %u expect 0", + datalen); + return -EUCLEAN; + } + + total_size = header_size + namelen + datalen; + + /* header and name/data should not cross item boundary */ + if (cur + total_size > item_end) { + generic_err(root, leaf, slot, + "structure data crosses item boundary, have %u expect (%u, %u]", + cur + total_size, cur + header_size, item_end); + return -EUCLEAN; + } + + cur += total_size; + } + return 0; +} + /* * Common point to switch the item-specific validation. */ @@ -238,6 +352,15 @@ static int check_leaf_item(struct btrfs_root *root, case BTRFS_EXTENT_CSUM_KEY: ret = check_csum_item(root, leaf, key, slot); break; + case BTRFS_DIR_ITEM_KEY: + case BTRFS_XATTR_ITEM_KEY: + case BTRFS_DIR_INDEX_KEY: + case BTRFS_INODE_REF_KEY: + case BTRFS_INODE_EXTREF_KEY: + case BTRFS_ROOT_REF_KEY: + case BTRFS_ROOT_BACKREF_KEY: + ret = check_variable_length_item(root, leaf, key, slot); + break; } return ret; }