Re: [PATCH 3/3] btrfs-progs: print-tree: Enhance btrfs_print_tree() check to avoid out-of-boundary memory access

[David Sterba <dsterba@suse.cz>]

On Mon, Apr 30, 2018 at 11:51:19AM +0800, Qu Wenruo wrote:
> >>           btrfs_print_leaf(eb);
> >>           return;
> >>       }
> >> +    /* We are crossing eb boundary, this node must be corrupted */
> >> +    if (nr > BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb))
> >> +        warning(
> >> +        "node nr_items corrupted, has %u limit %u, continue print
> >> anyway",
> >> +            nr, BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb));
> >>       printf("node %llu level %d items %d free %u generation %llu
> >> owner ",
> >>              (unsigned long long)eb->start,
> >>               btrfs_header_level(eb), nr,
> >> @@ -1386,7 +1391,11 @@ void btrfs_print_tree(struct extent_buffer *eb,
> >> int follow)
> >>       print_uuids(eb);
> >>       fflush(stdout);
> >>          
> >> -        u64 blocknr = btrfs_node_blockptr(eb, i);
> >> +        u64 blocknr;
> >> +
> >> +        if (i > BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb))
> >> +            break;
> > 
> > Should it be i >= BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb)?
> 
> BTRFS_NODEPTRS_PER_EXTENT_BUFFER() provides the maximum valid number.
> So it 's >=.
> 
> > 
> > Here BTRFS_NODEPTRS_PER_EXTENT_BUFFER() is called during iterations.
> > The judement can be calculated in advance like:
> > 
> >     ptr_num = BTRFS_NODEPTRS_PER_EXTENT_BUFFER(eb);
> >     ...
> >     for (i = 0; i < nr && i < ptr_num  ; i++) {
> 
> Indeed looks better.

Please resend this patch with the suggested updates, thanks.