From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFE6A396D22 for ; Thu, 19 Mar 2026 23:01:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773961263; cv=none; b=IoWyTKX0Tz6BCFGrjJfzZytwRoTtirrUMMGyEAS4jmVJmevMJTWuag5iA/8DBWkspiRt2wEE+CHofmHIZJZFGWvOFgarWWyOUR3R+9eCQNjRRRDyk4+PmqdOniTfifpR42z4XUaq7YqX4kyIzQQcJ0bdcrlw8kZknIXaKvpR9+o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773961263; c=relaxed/simple; bh=q27h7aXvzUDBcEG4AFH8pgmQJuOKChXYZNKuDx3bMQE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ncoD1ptmjZCjUKqxJIrSY8KAt9+Mcb8/eRUD7PaCVM9EwJjIOSjGCtIIvv8VFC06iVrwSUze4+0LeKCxAasoPzQCPn4vxVqXZyVOeggLN7usNdpXfZqfh3C1gdguVK7ysStWvgED/bPHk8eCcG0gl4mtvEYCyGPp+V9HiqZYJIY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GOxAkJAR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GOxAkJAR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1CE2BC19424; Thu, 19 Mar 2026 23:01:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773961262; bh=q27h7aXvzUDBcEG4AFH8pgmQJuOKChXYZNKuDx3bMQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GOxAkJAR2bI5frGkK9tmOSOFcWsyAuHk/lvMFBC6yWkG+8xgbnY64gBRtqeE964gP QTefe4t3sqDSaYpYykEWanp47RSWKBtQYfKanVaTJ8u6923mhO9eUAa3h8NTIKCDwc diHOiOvy7H3SJKyFHYoaRqvYEfdGe9YeuxZn1GgSa2lMJ+rwVhfuFaEoCrkw5pHcp1 Ip0KcoZDb5gHdU8KNa4+DyLgEMHeSXr4+MKXpZYpblGwiU0t59MYXkItFiZjA8erAT +na9F6okIYOrybalCCBdnjhRRgECf+3vxeFzZCFiboNjjSTcga6NpWGpKlQwLobzr3 +pCKOuFIwfvRA== From: Sasha Levin To: stable@vger.kernel.org Cc: Filipe Manana , Anand Jain , David Sterba , Sasha Levin Subject: [PATCH 5.15.y] btrfs: fix transaction abort on set received ioctl due to item overflow Date: Thu, 19 Mar 2026 19:01:00 -0400 Message-ID: <20260319230100.3145557-1-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <2026031752-outspoken-doorpost-d583@gregkh> References: <2026031752-outspoken-doorpost-d583@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Filipe Manana [ Upstream commit 87f2c46003fce4d739138aab4af1942b1afdadac ] If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction since we did some metadata updates before. This means that if a user calls this ioctl with the same received UUID field for a lot of subvolumes, we will hit the overflow, trigger the transaction abort and turn the filesystem into RO mode. A malicious user could exploit this, and this ioctl does not even requires that a user has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume. Fix this by doing an early check for item overflow before starting a transaction. This is also race safe because we are holding the subvol_sem semaphore in exclusive (write) mode. A test case for fstests will follow soon. Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree") CC: stable@vger.kernel.org # 3.12+ Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba [ A whole bunch of small things :) ] Signed-off-by: Sasha Levin --- fs/btrfs/ctree.h | 2 ++ fs/btrfs/ioctl.c | 21 ++++++++++++++++++-- fs/btrfs/uuid-tree.c | 46 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 61ec4ba5414d5..76601627b8b48 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -3065,6 +3065,8 @@ int btrfs_uuid_tree_add(struct btrfs_trans_handle *trans, u8 *uuid, u8 type, u64 subid); int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type, u64 subid); +int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info, + u8 *uuid, u8 type); int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info); /* dir-item.c */ diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 6c97610e90bfb..e299eae7317d5 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -4507,6 +4507,25 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file, goto out; } + received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid, + BTRFS_UUID_SIZE); + + /* + * Before we attempt to add the new received uuid, check if we have room + * for it in case there's already an item. If the size of the existing + * item plus this root's ID (u64) exceeds the maximum item size, we can + * return here without the need to abort a transaction. If we don't do + * this check, the btrfs_uuid_tree_add() call below would fail with + * -EOVERFLOW and result in a transaction abort. Malicious users could + * exploit this to turn the fs into RO mode. + */ + if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) { + ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid, + BTRFS_UUID_KEY_RECEIVED_SUBVOL); + if (ret < 0) + goto out; + } + /* * 1 - root item * 2 - uuid items (received uuid + subvol uuid) @@ -4522,8 +4541,6 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file, sa->rtime.sec = ct.tv_sec; sa->rtime.nsec = ct.tv_nsec; - received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid, - BTRFS_UUID_SIZE); if (received_uuid_changed && !btrfs_is_empty_uuid(root_item->received_uuid)) { ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid, diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c index 74023c8a783f1..55e80c99efd8a 100644 --- a/fs/btrfs/uuid-tree.c +++ b/fs/btrfs/uuid-tree.c @@ -225,6 +225,52 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type, return ret; } +/* + * Check if we can add one root ID to a UUID key. + * If the key does not yet exists, we can, otherwise only if extended item does + * not exceeds the maximum item size permitted by the leaf size. + * + * Returns 0 on success, negative value on error. + */ +int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info, + u8 *uuid, u8 type) +{ + struct btrfs_path *path = NULL; + int ret; + u32 item_size; + struct btrfs_key key; + + if (WARN_ON_ONCE(!fs_info->uuid_root)) { + ret = -EINVAL; + goto out; + } + + path = btrfs_alloc_path(); + if (!path) { + ret = -ENOMEM; + goto out; + } + + btrfs_uuid_to_key(uuid, type, &key); + ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0); + if (ret < 0) + goto out; + if (ret > 0) { + ret = 0; + goto out; + } + + item_size = btrfs_item_size(path->nodes[0], path->slots[0]); + + if (sizeof(struct btrfs_item) + item_size + sizeof(u64) > + BTRFS_LEAF_DATA_SIZE(fs_info)) + ret = -EOVERFLOW; + +out: + btrfs_free_path(path); + return ret; +} + static int btrfs_uuid_iter_rem(struct btrfs_root *uuid_root, u8 *uuid, u8 type, u64 subid) { -- 2.51.0