[PATCH 0/3] btrfs-progs: fix btrfs_root_item related memory bugs

[Qu Wenruo <wqu@suse.com>]

https://github.com/kdave/btrfs-progs/pull/1201

There is a security researcher, that exposeed a bug in btrfs root item
reading code, and that bug itself is valid.

So here we're fixing it mostly by introducing a dedicated helper to
handle the possible different sizes of btrfs_root_item.

Unfortunately we can not benefit from tree-checker, as a lot of tools
are designed to skip tree-checker, e.g. btrfs-check --repair can repair
certain item size related bugs, so it must skipping tree-checker or it
can not even open the fs.

The first patch is a small fix noticed during development.
The second one is the main fix related to btrfs_root_item reading.
The last one is two minor fixes related to btrfs_root_item writing.

Qu Wenruo (3):
  btrfs-progs: return error if btrfs_next_leaf() failed in
    do_list_roots()
  btrfs-progs: fix root_item reads which can cause memory bugs
  btrfs-progs: fix two sites that may write beyond root item size

 check/main.c               | 57 ++++++++++++++++++++++++++++----------
 cmds/inspect-dump-tree.c   | 12 +++++---
 cmds/restore.c             | 18 ++++++++----
 kernel-shared/disk-io.c    | 21 +++++++++-----
 kernel-shared/extent_io.c  | 34 +++++++++++++++++++++++
 kernel-shared/extent_io.h  |  3 ++
 kernel-shared/print-tree.c | 16 +++++++++--
 kernel-shared/root-tree.c  |  8 ++++--
 8 files changed, 133 insertions(+), 36 deletions(-)

--
2.56.0