I didn't check but "repair" should be made able to fix this situation
on an existing fs fairly easily by zeroing the BLOCK_GROUP_RAID10-bit
in case sub_stripes is zero or some unreasonable number and set the
bit in case sub_stripes has a reasonable, small value.
2015-04-23 5:00 GMT+02:00 Qu Wenruo <quwen...@cn.fujitsu.com>:
> Although only RAID10 use sub_stripes, a hostile attack can modify chunk
> tree and just add RAID10 bit to a single chunk.
> Then btrfs_map_block will trigger a 0 division in kernel and destroy
> everything.
>
> Just add extra check when reading chunk from disk.
>
> Reported-by: Lukas Lueg <lukas.l...@gmail.com>
> Signed-off-by: Qu Wenruo <quwen...@cn.fujitsu.com>
> ---
> fs/btrfs/volumes.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 8222f6f..a764726 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -6061,6 +6061,14 @@ static int read_one_chunk(struct btrfs_root *root,
> struct btrfs_key *key,
> map->stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
> map->type = btrfs_chunk_type(leaf, chunk);
> map->sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
> +
> + /* Add extra check to avoid hostile 0 division attack */
> + if (map->type & BTRFS_BLOCK_GROUP_RAID10 &&
> + map->sub_stripes == 0) {
> + free_extent_map(em);
> + return -EINVAL;
> + }
> +
> for (i = 0; i < num_stripes; i++) {
> map->stripes[i].physical =
> btrfs_stripe_offset_nr(leaf, chunk, i);
> --
> 2.3.5
>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
