Received: by 2002:a25:1985:0:0:0:0:0 with SMTP id 127csp2345696ybz; Thu, 23 Apr 2020 16:26:51 -0700 (PDT) X-Google-Smtp-Source: APiQypI77P1kQgGibYn8ee68RFwR94wbMusRnty3C6e9Z+JqF69oHjyu5v6F/+SnEpe9d3a1uh1E X-Received: by 2002:a17:906:49d0:: with SMTP id w16mr4672964ejv.364.1587684410825; Thu, 23 Apr 2020 16:26:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1587684410; cv=none; d=google.com; s=arc-20160816; b=FWvo6PqynjnZtTPh2/V23PK7jdzbX73gHN9JIe2q19VPW1M5e4Wlbe+RyGbX7uSS9t I9OdzBn02fD+eCIXJ3pRdIWOWlqc95DRxO5oA+ma/2CRiXB4c9QwRkLMVVry+LqXiTx7 Ezjw90O4onzR5DEkDTbpJzU2KFP/xwtKgHr92Lnpk2z+qittElp8zRTQN1Njmh0ah7Nd xjxTjJSP3JCLlNXLdsTKkzrJ4UcXkbC8LGV7oycZB04/E+Xeu7rIje8mlnC5CuEX/AOp T/mmIG4twpSeSyssJXKzpwXyFJFskux5MpqmTMJygZ/aVEx5g0nQeuXrpI+x6L6lkKYP +V6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition; bh=68nOePnzazOgYRaYn6EFAdfl1hHM0fpr3eFDyrJl1Pc=; b=bBnstWwnFwW9OcQP1ZF59sW4aTyUFZbAgRYJ6TIS2l0X8LZ0UIsnwckYMBMT4z4yiw u2zt0xQPyzfmBvBxfCovu+mWVrGhzZW8kF3T6PUOx6rvrmpn0SJSwY2Q8Rd2aCApMg7i QBW6oWGxFxbhPgnuG6Doe65CaAq0xV2/S8CB+KfWOJNwZNl+r8pUvZWzwWiI0tMq+L0T IntYx0D17eTQ0TxXgW7aNybHpiaOpNmt3d0tPEzlahAceya0LzaPZy66zu0K2PjcLTeI 4uKOa2/4VVzLh7EB9dEPDfTCGfBCbCS3pb9a71dyvIscsXDvh6yFHwMsSUOdK7SLvxIv gULg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ly8si2011173ejb.254.2020.04.23.16.26.27; Thu, 23 Apr 2020 16:26:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729224AbgDWXZA (ORCPT + 99 others); Thu, 23 Apr 2020 19:25:00 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:48208 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728103AbgDWXG2 (ORCPT ); Thu, 23 Apr 2020 19:06:28 -0400 Received: from [192.168.4.242] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1jRkvJ-0004a2-2v; Fri, 24 Apr 2020 00:06:25 +0100 Received: from ben by deadeye with local (Exim 4.93) (envelope-from ) id 1jRkvI-00E6g2-90; Fri, 24 Apr 2020 00:06:24 +0100 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, Denis Kirjanov , "Jiri Slaby" , "Vegard Nossum" , "David Sterba" Date: Fri, 24 Apr 2020 00:04:11 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) X-Patchwork-Hint: ignore Subject: [PATCH 3.16 024/245] btrfs: handle invalid num_stripes in sys_array In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.242 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.83-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: David Sterba commit f5cdedd73fa71b74dcc42f2a11a5735d89ce7c4f upstream. We can handle the special case of num_stripes == 0 directly inside btrfs_read_sys_array. The BUG_ON in btrfs_chunk_item_size is there to catch other unhandled cases where we fail to validate external data. A crafted or corrupted image crashes at mount time: BTRFS: device fsid 9006933e-2a9a-44f0-917f-514252aeec2c devid 1 transid 7 /dev/loop0 BTRFS info (device loop0): disk space caching is enabled BUG: failure at fs/btrfs/ctree.h:337/btrfs_chunk_item_size()! Kernel panic - not syncing: BUG! CPU: 0 PID: 313 Comm: mount Not tainted 4.2.5-00657-ge047887-dirty #25 Stack: 637af890 60062489 602aeb2e 604192ba 60387961 00000011 637af8a0 6038a835 637af9c0 6038776b 634ef32b 00000000 Call Trace: [<6001c86d>] show_stack+0xfe/0x15b [<6038a835>] dump_stack+0x2a/0x2c [<6038776b>] panic+0x13e/0x2b3 [<6020f099>] btrfs_read_sys_array+0x25d/0x2ff [<601cfbbe>] open_ctree+0x192d/0x27af [<6019c2c1>] btrfs_mount+0x8f5/0xb9a [<600bc9a7>] mount_fs+0x11/0xf3 [<600d5167>] vfs_kern_mount+0x75/0x11a [<6019bcb0>] btrfs_mount+0x2e4/0xb9a [<600bc9a7>] mount_fs+0x11/0xf3 [<600d5167>] vfs_kern_mount+0x75/0x11a [<600d710b>] do_mount+0xa35/0xbc9 [<600d7557>] SyS_mount+0x95/0xc8 [<6001e884>] handle_syscall+0x6b/0x8e Reported-by: Jiri Slaby Reported-by: Vegard Nossum Signed-off-by: David Sterba Signed-off-by: Ben Hutchings --- fs/btrfs/volumes.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6092,6 +6092,14 @@ int btrfs_read_sys_array(struct btrfs_ro goto out_short_read; num_stripes = btrfs_chunk_num_stripes(sb, chunk); + if (!num_stripes) { + printk(KERN_ERR + "BTRFS: invalid number of stripes %u in sys_array at offset %u\n", + num_stripes, cur_offset); + ret = -EIO; + break; + } + len = btrfs_chunk_item_size(num_stripes); if (cur_offset + len > array_size) goto out_short_read;