[PATCH] Fix incorrect address reference in btrfs

[PATCH] Fix incorrect address reference in btrfs

[Michael Chang]

We encountered a weird random kernel initrd unpacking error on btrfs
and finally found it was caused by incorrect address reference in range
check for type GRUB_BTRFS_EXTENT_REGULAR and the entire result is
unpredictable.

This is a quick fix to make the address reference to the
grub_btrfs_entent_data structure correctly, not the pointer variable
to it.

Any suggestions to this patch is welcome.
---
 grub-core/fs/btrfs.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
index f7b6c15..95a8fa6 100644
--- a/grub-core/fs/btrfs.c
+++ b/grub-core/fs/btrfs.c
@@ -1051,7 +1051,7 @@ grub_btrfs_extent_read (struct grub_btrfs_data *data,
 
 	  data->extend = data->extstart + grub_le_to_cpu64 (data->extent->size);
 	  if (data->extent->type == GRUB_BTRFS_EXTENT_REGULAR
-	      && (char *) &data->extent + elemsize
+	      && (char *) data->extent + elemsize
 	      >= (char *) &data->extent->filled + sizeof (data->extent->filled))
 	    data->extend =
 	      data->extstart + grub_le_to_cpu64 (data->extent->filled);
-- 
1.7.3.4

Re: [PATCH] Fix incorrect address reference in btrfs

[Michael Chang]

CC Takashi and Jeff

On Thu, Aug 14, 2014 at 06:17:45PM +0800, Michael Chang wrote:
> We encountered a weird random kernel initrd unpacking error on btrfs
> and finally found it was caused by incorrect address reference in range
> check for type GRUB_BTRFS_EXTENT_REGULAR and the entire result is
> unpredictable.
> 
> This is a quick fix to make the address reference to the
> grub_btrfs_entent_data structure correctly, not the pointer variable
> to it.
> 
> Any suggestions to this patch is welcome.
> ---
>  grub-core/fs/btrfs.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
> index f7b6c15..95a8fa6 100644
> --- a/grub-core/fs/btrfs.c
> +++ b/grub-core/fs/btrfs.c
> @@ -1051,7 +1051,7 @@ grub_btrfs_extent_read (struct grub_btrfs_data *data,
>  
>  	  data->extend = data->extstart + grub_le_to_cpu64 (data->extent->size);
>  	  if (data->extent->type == GRUB_BTRFS_EXTENT_REGULAR
> -	      && (char *) &data->extent + elemsize
> +	      && (char *) data->extent + elemsize
>  	      >= (char *) &data->extent->filled + sizeof (data->extent->filled))
>  	    data->extend =
>  	      data->extstart + grub_le_to_cpu64 (data->extent->filled);
> -- 
> 1.7.3.4
> 
> 
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH] Fix incorrect address reference in btrfs

[Colin Watson]

On Thu, Aug 14, 2014 at 06:50:00PM +0800, Michael Chang wrote:
> On Thu, Aug 14, 2014 at 06:17:45PM +0800, Michael Chang wrote:
> > We encountered a weird random kernel initrd unpacking error on btrfs
> > and finally found it was caused by incorrect address reference in range
> > check for type GRUB_BTRFS_EXTENT_REGULAR and the entire result is
> > unpredictable.
> > 
> > This is a quick fix to make the address reference to the
> > grub_btrfs_entent_data structure correctly, not the pointer variable
> > to it.
> > 
> > Any suggestions to this patch is welcome.

Looks good to me, thanks.  Added a ChangeLog entry and pushed to master.

-- 
Colin Watson                                       [cjwatson@ubuntu.com]