diff options
| author | Qu Wenruo <wqu@suse.com> | 2018-07-03 12:10:05 +0300 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-08-06 14:12:41 +0300 |
| commit | fce466eab7ac6baa9d2dcd88abcf945be3d4a089 (patch) | |
| tree | b1dfc302a5c93cf38ab82bf11cdabc2b47dc9f91 /fs/btrfs/volumes.h | |
| parent | 6d8ff4e4584cd84093b751671351c8103ead551d (diff) | |
| download | linux-fce466eab7ac6baa9d2dcd88abcf945be3d4a089.tar.xz | |
btrfs: tree-checker: Verify block_group_item
A crafted image with invalid block group items could make free space cache
code to cause panic.
We could detect such invalid block group item by checking:
1) Item size
Known fixed value.
2) Block group size (key.offset)
We have an upper limit on block group item (10G)
3) Chunk objectid
Known fixed value.
4) Type
Only 4 valid type values, DATA, METADATA, SYSTEM and DATA|METADATA.
No more than 1 bit set for profile type.
5) Used space
No more than the block group size.
This should allow btrfs to detect and refuse to mount the crafted image.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199849
Reported-by: Xu Wen <wen.xu@gatech.edu>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Gu Jinxiang <gujx@cn.fujitsu.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Tested-by: Gu Jinxiang <gujx@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/volumes.h')
| -rw-r--r-- | fs/btrfs/volumes.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h index df2d8bdf8c9a..275c31c730cf 100644 --- a/fs/btrfs/volumes.h +++ b/fs/btrfs/volumes.h @@ -11,6 +11,8 @@ #include <linux/btrfs.h> #include "async-thread.h" +#define BTRFS_MAX_DATA_CHUNK_SIZE (10ULL * SZ_1G) + extern struct mutex uuid_mutex; #define BTRFS_STRIPE_LEN SZ_64K |