From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-co1nam03on0118.outbound.protection.outlook.com ([104.47.40.118]:6016 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727523AbeH3WMR (ORCPT ); Thu, 30 Aug 2018 18:12:17 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Qu Wenruo , David Sterba , Sasha Levin Subject: [PATCH AUTOSEL 4.18 109/113] btrfs: tree-checker: Detect invalid and empty essential trees Date: Thu, 30 Aug 2018 18:08:36 +0000 Message-ID: <20180830180714.36167-43-alexander.levin@microsoft.com> References: <20180830180714.36167-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180714.36167-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Qu Wenruo [ Upstream commit ba480dd4db9f1798541eb2d1c423fc95feee8d36 ] A crafted image has empty root tree block, which will later cause NULL pointer dereference. The following trees should never be empty: 1) Tree root Must contain at least root items for extent tree, device tree and fs tree 2) Chunk tree Or we can't even bootstrap as it contains the mapping. 3) Fs tree At least inode item for top level inode (.). 4) Device tree Dev extents for chunks 5) Extent tree Must have corresponding extent for each chunk. If any of them is empty, we are sure the fs is corrupted and no need to mount it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D199847 Reported-by: Xu Wen Signed-off-by: Qu Wenruo Tested-by: Gu Jinxiang Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/btrfs/tree-checker.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c index 8d40e7dd8c30..d014af352ce0 100644 --- a/fs/btrfs/tree-checker.c +++ b/fs/btrfs/tree-checker.c @@ -396,9 +396,22 @@ static int check_leaf(struct btrfs_fs_info *fs_info, s= truct extent_buffer *leaf, * skip this check for relocation trees. */ if (nritems =3D=3D 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)= ) { + u64 owner =3D btrfs_header_owner(leaf); struct btrfs_root *check_root; =20 - key.objectid =3D btrfs_header_owner(leaf); + /* These trees must never be empty */ + if (owner =3D=3D BTRFS_ROOT_TREE_OBJECTID || + owner =3D=3D BTRFS_CHUNK_TREE_OBJECTID || + owner =3D=3D BTRFS_EXTENT_TREE_OBJECTID || + owner =3D=3D BTRFS_DEV_TREE_OBJECTID || + owner =3D=3D BTRFS_FS_TREE_OBJECTID || + owner =3D=3D BTRFS_DATA_RELOC_TREE_OBJECTID) { + generic_err(fs_info, leaf, 0, + "invalid root, root %llu must never be empty", + owner); + return -EUCLEAN; + } + key.objectid =3D owner; key.type =3D BTRFS_ROOT_ITEM_KEY; key.offset =3D (u64)-1; =20 --=20 2.17.1