On 3.07.2018 12:10, Qu Wenruo wrote: > A crafted image with invalid block group items could make free space cache > code to cause panic. > > We could early detect such invalid block group item by checking: > 1) Item size > Fixed value. > 2) Block group size (key.offset) > We have a up limit on block group item (10G) > 3) Chunk objectid > Fixed value. > 4) Type > Only 4 valid type values, DATA, METADATA, SYSTEM and DATA|METADATA. > No more than 1 bit set for profile type. > 5) Used space > No more than block group size. > > This should allow btrfs to detect and refuse to mount the crafted image. > > Link: https://bugzilla.kernel.org/show_bug.cgi?id=199849 > Reported-by: Xu Wen <wen.xu@xxxxxxxxxx> > Signed-off-by: Qu Wenruo <wqu@xxxxxxxx> Reviewed-by: Nikolay Borisov <nborisov@xxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
