Re: [PATCH] btrfs: check if there is space for chunk item when validating sys chunk array

[Qu Wenruo <wqu@suse.com>]

在 2026/9/17 01:41, fdmanana@kernel.org 写道:
> From: Filipe Manana <fdmanana@suse.com>
> 
> We checked if have enough remaining space for a key before dereferencing a
> key, but we then dereference a chunk item, to get the number of stripes,
> without checking if there is space for the item. So add a check to see if
> there is enough space for a chunk item before dereferencing the item to
> extract the stripe count.
> 
> Fixes: 2a9bb78cfd36 ("btrfs: validate system chunk array at btrfs_validate_super()")
> Signed-off-by: Filipe Manana <fdmanana@suse.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

Thanks,
Qu

> ---
>   fs/btrfs/disk-io.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
> index a1d83ad9a4c0..94a7e9059a7b 100644
> --- a/fs/btrfs/disk-io.c
> +++ b/fs/btrfs/disk-io.c
> @@ -2370,6 +2370,10 @@ static int validate_sys_chunk_array(const struct btrfs_fs_info *fs_info,
>   				  key.type, cur);
>   			return -EUCLEAN;
>   		}
> +
> +		if (unlikely(cur + sizeof(*chunk) > sys_array_size))
> +			goto short_read;
> +
>   		chunk = (struct btrfs_chunk *)(sb->sys_chunk_array + cur);
>   		num_stripes = btrfs_stack_chunk_num_stripes(chunk);
>   		if (unlikely(cur + btrfs_chunk_item_size(num_stripes) > sys_array_size))