From patchwork Mon May 21 05:19:27 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qu Wenruo X-Patchwork-Id: 10413969 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C1DC26016C for ; Mon, 21 May 2018 05:19:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B3E1C28758 for ; Mon, 21 May 2018 05:19:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A0DD928782; Mon, 21 May 2018 05:19:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 56E1E28758 for ; Mon, 21 May 2018 05:19:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751160AbeEUFTl (ORCPT ); Mon, 21 May 2018 01:19:41 -0400 Received: from mx2.suse.de ([195.135.220.15]:57664 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750823AbeEUFTf (ORCPT ); Mon, 21 May 2018 01:19:35 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 90646AD4E for ; Mon, 21 May 2018 05:19:34 +0000 (UTC) From: Qu Wenruo To: linux-btrfs@vger.kernel.org Subject: [PATCH v2 4/4] btrfs: lzo: Harden inline lzo compressed extent decompression Date: Mon, 21 May 2018 13:19:27 +0800 Message-Id: <20180521051927.3715-5-wqu@suse.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180521051927.3715-1-wqu@suse.com> References: <20180521051927.3715-1-wqu@suse.com> Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Unlike regular lzo compressed extent, inline extent doesn't have Header and only has one Segment. And further more, inlined extent always has csum in its leaf header, it's less possible to have corrupted data. Anyway, still add extra segment header length check. Signed-off-by: Qu Wenruo --- fs/btrfs/lzo.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c index 4c75dcba3f04..28788f6f0add 100644 --- a/fs/btrfs/lzo.c +++ b/fs/btrfs/lzo.c @@ -425,6 +425,7 @@ static int lzo_decompress(struct list_head *ws, unsigned char *data_in, struct workspace *workspace = list_entry(ws, struct workspace, list); size_t in_len; size_t out_len; + size_t max_segment_len = lzo1x_worst_compress(PAGE_SIZE); int ret = 0; char *kaddr; unsigned long bytes; @@ -434,6 +435,10 @@ static int lzo_decompress(struct list_head *ws, unsigned char *data_in, data_in += LZO_LEN; in_len = read_compress_length(data_in); + if (in_len > max_segment_len) { + ret = -EUCLEAN; + goto out; + } data_in += LZO_LEN; out_len = PAGE_SIZE;