Re: [PATCH v2 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-28 Thread David Sterba
On Fri, May 25, 2018 at 09:31:30AM +0800, Qu Wenruo wrote: > > > On 2018年05月25日 00:43, David Sterba wrote: > > On Wed, May 23, 2018 at 07:38:28AM +0800, Qu Wenruo wrote: > --- a/fs/btrfs/lzo.c > +++ b/fs/btrfs/lzo.c > @@ -281,6 +281,7 @@ static int lzo_decompress_bio(struct

Re: [PATCH v2 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-24 Thread David Sterba
On Wed, May 23, 2018 at 07:38:28AM +0800, Qu Wenruo wrote: > >> --- a/fs/btrfs/lzo.c > >> +++ b/fs/btrfs/lzo.c > >> @@ -281,6 +281,7 @@ static int lzo_decompress_bio(struct list_head *ws, > >> struct compressed_bio *cb) > >>unsigned long working_bytes; > >>size_t in_len; > >>size_t

Re: [PATCH v2 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-22 Thread Qu Wenruo
On 2018年05月22日 23:06, David Sterba wrote: > On Mon, May 21, 2018 at 01:19:26PM +0800, Qu Wenruo wrote: >> James Harvey reported that some corrupted compressed extent data can >> lead to various kernel memory corruption. >> >> Such corrupted extent data belongs to inode with NODATASUM flags, thus

Re: [PATCH v2 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-22 Thread David Sterba
On Mon, May 21, 2018 at 01:19:26PM +0800, Qu Wenruo wrote: > James Harvey reported that some corrupted compressed extent data can > lead to various kernel memory corruption. > > Such corrupted extent data belongs to inode with NODATASUM flags, thus > data csum won't help us detecting such bug. >

[PATCH v2 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-20 Thread Qu Wenruo
James Harvey reported that some corrupted compressed extent data can lead to various kernel memory corruption. Such corrupted extent data belongs to inode with NODATASUM flags, thus data csum won't help us detecting such bug. If lucky enough, kasan could catch it like: