leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
eae8d82529
linux/fs/btrfs
History
Qu Wenruo eae8d82529 btrfs: Fix wild memory access in compression level parser 
[BUG]
Kernel panic when mounting with "-o compress" mount option.
KASAN will report like:
------
==================================================================
BUG: KASAN: wild-memory-access in strncmp+0x31/0xc0
Read of size 1 at addr d86735fce994f800 by task mount/662
...
Call Trace:
 dump_stack+0xe3/0x175
 kasan_report+0x163/0x370
 __asan_load1+0x47/0x50
 strncmp+0x31/0xc0
 btrfs_compress_str2level+0x20/0x70 [btrfs]
 btrfs_parse_options+0xff4/0x1870 [btrfs]
 open_ctree+0x2679/0x49f0 [btrfs]
 btrfs_mount+0x1b7f/0x1d30 [btrfs]
 mount_fs+0x49/0x190
 vfs_kern_mount.part.29+0xba/0x280
 vfs_kern_mount+0x13/0x20
 btrfs_mount+0x31e/0x1d30 [btrfs]
 mount_fs+0x49/0x190
 vfs_kern_mount.part.29+0xba/0x280
 do_mount+0xaad/0x1a00
 SyS_mount+0x98/0xe0
 entry_SYSCALL_64_fastpath+0x1f/0xbe
------

[Cause]
For 'compress' and 'compress_force' options, its token doesn't expect
any parameter so its args[0] contains uninitialized data.
Accessing args[0] will cause above wild memory access.

[Fix]
For Opt_compress and Opt_compress_force, set compression level to
the default.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ set the default in advance ]
Signed-off-by: David Sterba <dsterba@suse.com>
2017-11-27 17:01:11 +01:00
..
tests Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
acl.c btrfs: preserve i_mode if __btrfs_set_acl() fails 2017-08-21 17:47:42 +02:00
async-thread.c Btrfs: fix confusing worker helper info in stacktrace 2017-10-30 12:27:57 +01:00
async-thread.h btrfs: constify tracepoint arguments 2017-08-16 14:19:53 +02:00
backref.c btrfs: track refs in a rb_tree instead of a list 2017-11-01 20:45:35 +01:00
backref.h btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents 2017-11-01 20:45:34 +01:00
btrfs_inode.h btrfs: make the delalloc block rsv per inode 2017-11-01 20:45:35 +01:00
check-integrity.c btrfs: Fix bug for misused dev_t when lookup in dev state hash table. 2017-11-01 20:45:36 +01:00
check-integrity.h btrfs: take an fs_info directly when the root is not used otherwise 2016-12-06 16:06:59 +01:00
compression.c btrfs: Fix wild memory access in compression level parser 2017-11-27 17:01:11 +01:00
compression.h btrfs: Fix wild memory access in compression level parser 2017-11-27 17:01:11 +01:00
ctree.c btrfs: pass root to various extent ref mod functions 2017-10-30 12:28:00 +01:00
ctree.h Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
dedupe.h btrfs: expand cow_file_range() to support in-band dedup and subpage-blocksize 2016-07-26 13:52:25 +02:00
delayed-inode.c btrfs: make the delalloc block rsv per inode 2017-11-01 20:45:35 +01:00
delayed-inode.h btrfs: convert btrfs_delayed_item.refs from atomic_t to refcount_t 2017-04-18 14:07:23 +02:00
delayed-ref.c btrfs: track refs in a rb_tree instead of a list 2017-11-01 20:45:35 +01:00
delayed-ref.h btrfs: track refs in a rb_tree instead of a list 2017-11-01 20:45:35 +01:00
dev-replace.c Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:54:01 -07:00
dev-replace.h btrfs: constify device path passed to relevant helpers 2017-02-28 14:26:07 +01:00
dir-item.c btrfs: fix validation of XATTR_ITEM dir items 2017-06-29 20:06:11 +02:00
disk-io.c btrfs: track refs in a rb_tree instead of a list 2017-11-01 20:45:35 +01:00
disk-io.h btrfs: use named constant for bdev blocksize 2017-08-16 16:12:04 +02:00
export.c btrfs: Check name_len before reading btrfs_get_name 2017-06-21 19:16:04 +02:00
export.h
extent_io.c Btrfs: add write_flags for compression bio 2017-11-15 14:44:31 +01:00
extent_io.h Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
extent_map.c btrfs: convert extent_map.refs from atomic_t to refcount_t 2017-04-18 14:07:23 +02:00
extent_map.h btrfs: convert extent_map.refs from atomic_t to refcount_t 2017-04-18 14:07:23 +02:00
extent-tree.c btrfs: clear space cache inode generation always 2017-11-20 20:43:39 +01:00
file-item.c Merge branch 'for-4.13-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 2017-07-05 16:41:23 -07:00
file.c Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
free-space-cache.c btrfs: fix deadlock when writing out space cache 2017-11-27 15:50:07 +01:00
free-space-cache.h btrfs: free-space-cache, clean up unnecessary root arguments 2017-02-17 12:03:56 +01:00
free-space-tree.c btrfs: Clean up unused variables in free-space-tree.c 2017-10-30 12:27:59 +01:00
free-space-tree.h btrfs: expose internal free space tree routine only if sanity tests are enabled 2017-08-18 16:36:29 +02:00
hash.c crypto: Work around deallocated stack frame reference gcc bug on sparc. 2017-06-08 17:36:03 +08:00
hash.h btrfs: advertise which crc32c implementation is being used at module load 2016-06-06 14:08:28 +02:00
inode-item.c btrfs: take an fs_info directly when the root is not used otherwise 2016-12-06 16:06:59 +01:00
inode-map.c Btrfs: rework outstanding_extents 2017-11-01 20:45:35 +01:00
inode-map.h Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots 2016-01-15 19:25:02 +01:00
inode.c Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
ioctl.c Btrfs: rework outstanding_extents 2017-11-01 20:45:35 +01:00
Kconfig Btrfs: add a extent ref verify tool 2017-10-30 12:28:00 +01:00
locking.c
locking.h
lzo.c btrfs: allow to set compression level for zlib 2017-11-01 20:45:29 +01:00
Makefile Btrfs: add a extent ref verify tool 2017-10-30 12:28:00 +01:00
math.h
ordered-data.c Btrfs: rework outstanding_extents 2017-11-01 20:45:35 +01:00
ordered-data.h btrfs: fix integer overflow in calc_reclaim_items_nr 2017-06-29 20:17:02 +02:00
orphan.c
print-tree.c Btrfs: add one more sanity check for shared ref type 2017-08-21 17:47:43 +02:00
print-tree.h btrfs: get fs_info from eb in btrfs_print_tree, remove argument 2017-08-16 16:12:03 +02:00
props.c Merge branch 'zstd-minimal' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs 2017-09-14 17:30:49 -07:00
props.h
qgroup.c btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents 2017-11-01 20:45:34 +01:00
qgroup.h btrfs: qgroup: Fix qgroup reserved space underflow by only freeing reserved ranges 2017-06-29 20:17:02 +02:00
raid56.c Btrfs: fix memory leak in raid56 2017-10-30 12:27:57 +01:00
raid56.h btrfs: take an fs_info directly when the root is not used otherwise 2016-12-06 16:06:59 +01:00
rcu-string.h
reada.c btrfs: remove unused member err from reada_extent 2017-06-19 18:25:59 +02:00
ref-verify.c Btrfs: add a extent ref verify tool 2017-10-30 12:28:00 +01:00
ref-verify.h Btrfs: add a extent ref verify tool 2017-10-30 12:28:00 +01:00
relocation.c Btrfs: fix reported number of inode blocks after buffered append writes 2017-11-15 17:27:46 +01:00
root-tree.c btrfs: Clean up dead code in root-tree 2017-10-30 12:27:56 +01:00
scrub.c btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents 2017-11-01 20:45:34 +01:00
send.c btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents 2017-11-01 20:45:34 +01:00
send.h btrfs: fix send ioctl on 32bit with 64bit kernel 2017-10-30 12:27:59 +01:00
struct-funcs.c btrfs: struct-funcs, constify readers 2017-08-16 14:19:53 +02:00
super.c btrfs: Fix wild memory access in compression level parser 2017-11-27 17:01:11 +01:00
sysfs.c btrfs: prefix sysfs attribute struct names 2017-10-30 12:27:58 +01:00
sysfs.h btrfs: prefix sysfs attribute struct names 2017-10-30 12:27:58 +01:00
transaction.c btrfs: don't call btrfs_start_delalloc_roots in flushoncommit 2017-11-01 20:45:35 +01:00
transaction.h btrfs: remove unused qgroup members from btrfs_trans_handle 2017-04-18 14:07:25 +02:00
tree-checker.c btrfs: tree-checker: use %zu format string for size_t 2017-10-30 12:27:59 +01:00
tree-checker.h btrfs: Move leaf and node validation checker to tree-checker.c 2017-10-30 12:27:58 +01:00
tree-defrag.c
tree-log.c btrfs: pass root to various extent ref mod functions 2017-10-30 12:28:00 +01:00
tree-log.h btrfs: Make btrfs_del_inode_ref take btrfs_inode 2017-02-14 15:50:54 +01:00
ulist.c btrfs: ulist: rename ulist_fini to ulist_release 2017-02-17 12:03:50 +01:00
ulist.h btrfs: ulist: rename ulist_fini to ulist_release 2017-02-17 12:03:50 +01:00
uuid-tree.c btrfs: return the actual error value from from btrfs_uuid_tree_iterate 2016-12-19 18:08:15 +01:00
volumes.c btrfs: dev_alloc_list is not protected by RCU, use normal list_del 2017-11-15 14:46:12 +01:00
volumes.h btrfs: declare btrfs_report_missing_device() static 2017-10-30 12:27:59 +01:00
xattr.c btrfs: Check name_len with boundary in verify dir_item 2017-06-21 19:16:04 +02:00
xattr.h btrfs: Switch to generic xattr handlers 2016-05-17 19:17:09 -04:00
zlib.c btrfs: allow to set compression level for zlib 2017-11-01 20:45:29 +01:00
zstd.c btrfs: allow to set compression level for zlib 2017-11-01 20:45:29 +01:00