On 3.07.2018 12:10, Qu Wenruo wrote:
> A crafted image with invalid block group items could make free space cache
> code to cause panic.
>
> We could early detect such invalid block group item by checking:
> 1) Item size
> Fixed value.
> 2) Block group size (key.offset)
> We have a up limit on block group item (10G)
> 3) Chunk objectid
> Fixed value.
> 4) Type
> Only 4 valid type values, DATA, METADATA, SYSTEM and DATA|METADATA.
> No more than 1 bit set for profile type.
> 5) Used space
> No more than block group size.
>
> This should allow btrfs to detect and refuse to mount the crafted image.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=199849
> Reported-by: Xu Wen <wen...@gatech.edu>
> Signed-off-by: Qu Wenruo <w...@suse.com>
Reviewed-by: Nikolay Borisov <nbori...@suse.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
