From patchwork Mon Aug 29 08:09:02 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qu Wenruo X-Patchwork-Id: 9303263 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CE5EE608A1 for ; Mon, 29 Aug 2016 08:09:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BB4D62880C for ; Mon, 29 Aug 2016 08:09:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B07142882A; Mon, 29 Aug 2016 08:09:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4CC3C28821 for ; Mon, 29 Aug 2016 08:09:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932871AbcH2IJR (ORCPT ); Mon, 29 Aug 2016 04:09:17 -0400 Received: from cn.fujitsu.com ([59.151.112.132]:16776 "EHLO heian.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S932862AbcH2IJP (ORCPT ); Mon, 29 Aug 2016 04:09:15 -0400 X-IronPort-AV: E=Sophos;i="5.22,518,1449504000"; d="scan'208";a="10379811" Received: from unknown (HELO cn.fujitsu.com) ([10.167.33.5]) by heian.cn.fujitsu.com with ESMTP; 29 Aug 2016 16:09:12 +0800 Received: from G08CNEXCHPEKD02.g08.fujitsu.local (unknown [10.167.33.83]) by cn.fujitsu.com (Postfix) with ESMTP id 06CCD4334C72 for ; Mon, 29 Aug 2016 16:09:09 +0800 (CST) Received: from adam-work.localdomain (10.167.226.34) by G08CNEXCHPEKD02.g08.fujitsu.local (10.167.33.89) with Microsoft SMTP Server (TLS) id 14.3.279.2; Mon, 29 Aug 2016 16:09:12 +0800 From: Qu Wenruo To: Subject: [PATCH 4/4] btrfs-progs: Do extra chunk check before processing chunk item Date: Mon, 29 Aug 2016 16:09:02 +0800 Message-ID: <20160829080902.2952-5-quwenruo@cn.fujitsu.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20160829080902.2952-1-quwenruo@cn.fujitsu.com> References: <20160829080902.2952-1-quwenruo@cn.fujitsu.com> MIME-Version: 1.0 X-Originating-IP: [10.167.226.34] X-yoursite-MailScanner-ID: 06CCD4334C72.ACA15 X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: quwenruo@cn.fujitsu.com Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Current we only do chunk validation check at mount time. It's good for most case, but for fuzzed or manually crafted images, we can insert a CHUNK_ITEM key into root tree. Since mount time check will only check chunk tree, it will not check CHUNK_ITEM in root tree. Even with previous key type check against leaf owner, it is still possible to modify the leaf owner to by-pass it. So we still need to check chunk validation before processing it. Reported-by: Lukas Lueg Signed-off-by: Qu Wenruo --- cmds-check.c | 16 ++++++++++++++++ volumes.c | 8 ++++---- volumes.h | 4 ++++ 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/cmds-check.c b/cmds-check.c index 617b867..1e1f7c9 100644 --- a/cmds-check.c +++ b/cmds-check.c @@ -5220,8 +5220,24 @@ static int process_chunk_item(struct cache_tree *chunk_cache, int slot) { struct chunk_record *rec; + struct btrfs_chunk *chunk; int ret = 0; + chunk = btrfs_item_ptr(eb, slot, struct btrfs_chunk); + /* + * Do extra check for this chunk item, + * + * It's still possible one can craft a leaf with CHUNK_ITEM, with + * wrong onwer(3) out of chunk tree, to pass both chunk tree check + * and owner<->key_type check. + */ + ret = btrfs_check_chunk_valid(global_info->tree_root, eb, chunk, slot, + key->offset); + if (ret < 0) { + error("chunk(%llu, %llu) is not valid, ignore it", + key->offset, btrfs_chunk_length(eb, chunk)); + return 0; + } rec = btrfs_new_chunk_record(eb, key, slot); ret = insert_cache_extent(chunk_cache, &rec->cache); if (ret) { diff --git a/volumes.c b/volumes.c index 9a5580a..2d07e66 100644 --- a/volumes.c +++ b/volumes.c @@ -1614,10 +1614,10 @@ static struct btrfs_device *fill_missing_device(u64 devid) * slot == -1: SYSTEM chunk * return -EIO on error, otherwise return 0 */ -static int btrfs_check_chunk_valid(struct btrfs_root *root, - struct extent_buffer *leaf, - struct btrfs_chunk *chunk, - int slot, u64 logical) +int btrfs_check_chunk_valid(struct btrfs_root *root, + struct extent_buffer *leaf, + struct btrfs_chunk *chunk, + int slot, u64 logical) { u64 length; u64 stripe_len; diff --git a/volumes.h b/volumes.h index af7182b..d7b7d3c 100644 --- a/volumes.h +++ b/volumes.h @@ -226,4 +226,8 @@ int write_raid56_with_parity(struct btrfs_fs_info *info, struct extent_buffer *eb, struct btrfs_multi_bio *multi, u64 stripe_len, u64 *raid_map); +int btrfs_check_chunk_valid(struct btrfs_root *root, + struct extent_buffer *leaf, + struct btrfs_chunk *chunk, + int slot, u64 logical); #endif