Skip to content

Commit cef75dd

Browse files
adam900710kdave
authored andcommitted
btrfs-progs: print-tree: do sanity checks for dir items
There is a bug report that with UBSAN enabled, fuzz/006 test case crashes. It turns out that the image bko-154021-invalid-drop-level.raw has invalid dir items, that the name/data len is beyond the item. And if we try to read beyond the eb boundary, UBSAN got triggered. Normally in kernel tree-checker would reject such metadata in the first place, but in btrfs-progs we can not be that strict or we cannot do a lot of repair. So here just enhance print_dir_item() to do extra sanity checks for data/name len before reading the contents. Issue: #805 Signed-off-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
1 parent fd5a80e commit cef75dd

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

kernel-shared/print-tree.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,11 @@ static void print_dir_item(struct extent_buffer *eb, u32 size,
7878
printf("\n");
7979
name_len = btrfs_dir_name_len(eb, di);
8080
data_len = btrfs_dir_data_len(eb, di);
81+
if (data_len + name_len + cur > size) {
82+
error("invalid length, cur=%u name_len=%u data_len=%u size=%u",
83+
cur, name_len, data_len, size);
84+
break;
85+
}
8186
len = (name_len <= sizeof(namebuf))? name_len: sizeof(namebuf);
8287
printf("\t\ttransid %llu data_len %u name_len %u\n",
8388
btrfs_dir_transid(eb, di),

0 commit comments

Comments
 (0)