Skip to content

Commit 09abde4

Browse files
Anderson Nascimentokdave
authored andcommitted
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes). However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes). If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned. This results in an 8-byte out-of-bounds write at fid->parent_root_objectid = parent_root_id. A previous attempt to fix this issue was made but was lost. https://lore.kernel.org/all/[email protected]/ Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data. Fixes: be6e8dc ("NFS support for btrfs - v3") CC: [email protected] # 3.0+ Signed-off-by: Anderson Nascimento <[email protected]> Reviewed-by: David Sterba <[email protected]> Signed-off-by: David Sterba <[email protected]>
1 parent 45c2224 commit 09abde4

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

fs/btrfs/export.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,11 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
2323
int type;
2424

2525
if (parent && (len < BTRFS_FID_SIZE_CONNECTABLE)) {
26-
*max_len = BTRFS_FID_SIZE_CONNECTABLE;
26+
if (btrfs_root_id(BTRFS_I(inode)->root) !=
27+
btrfs_root_id(BTRFS_I(parent)->root))
28+
*max_len = BTRFS_FID_SIZE_CONNECTABLE_ROOT;
29+
else
30+
*max_len = BTRFS_FID_SIZE_CONNECTABLE;
2731
return FILEID_INVALID;
2832
} else if (len < BTRFS_FID_SIZE_NON_CONNECTABLE) {
2933
*max_len = BTRFS_FID_SIZE_NON_CONNECTABLE;
@@ -45,6 +49,8 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
4549
parent_root_id = btrfs_root_id(BTRFS_I(parent)->root);
4650

4751
if (parent_root_id != fid->root_objectid) {
52+
if (*max_len < BTRFS_FID_SIZE_CONNECTABLE_ROOT)
53+
return FILEID_INVALID;
4854
fid->parent_root_objectid = parent_root_id;
4955
len = BTRFS_FID_SIZE_CONNECTABLE_ROOT;
5056
type = FILEID_BTRFS_WITH_PARENT_ROOT;

0 commit comments

Comments
 (0)