When user assign qgroup with qgroup id that is too big to exceeds range and invade level value, and it works without any error. but this action would be make undefined error. this code make sure that qgroup id doesn't exceed range [0, 2^48-1]. and also checks qgroup level that is in range [0, 2^16-1].
Signed-off-by: Sidong Yang <realwa...@gmail.com> --- v2: Use btrfs_qgroup_level() for checking v3: Add checks for qgroup level --- common/utils.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/common/utils.c b/common/utils.c index 57e41432..69fa6096 100644 --- a/common/utils.c +++ b/common/utils.c @@ -708,6 +708,10 @@ u64 parse_size_from_string(const char *s) return ret; } +static bool valid_qgroup_level(u64 level) { + return !(level >> (sizeof(level) * 8 - BTRFS_QGROUP_LEVEL_SHIFT)); +} + u64 parse_qgroupid(const char *p) { char *s = strchr(p, '/'); @@ -727,15 +731,23 @@ u64 parse_qgroupid(const char *p) id = strtoull(p, &ptr_parse_end, 10); if (ptr_parse_end != ptr_src_end) goto path; + if (btrfs_qgroup_level(id)) + goto err; return id; } level = strtoull(p, &ptr_parse_end, 10); if (ptr_parse_end != s) goto path; + if (!valid_qgroup_level(level)) + goto err; + id = strtoull(s + 1, &ptr_parse_end, 10); if (ptr_parse_end != ptr_src_end) - goto path; + goto path; + + if (btrfs_qgroup_level(id)) + goto err; return (level << BTRFS_QGROUP_LEVEL_SHIFT) | id; -- 2.25.1