Re: [PATCH 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-22 Thread David Sterba
On Thu, May 17, 2018 at 11:14:46AM +0300, Nikolay Borisov wrote: > srclen comes from the async_extent struct, which in turns is > initialized in compress_file_range with the value of "total_compressed", > and the value there is actually initialized by > btrfs_compress_pages->lzo_compress_pages (th

Re: [PATCH 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-17 Thread Qu Wenruo
On 2018年05月17日 16:19, Qu Wenruo wrote: > > > On 2018年05月17日 16:14, Nikolay Borisov wrote: >> >> >> On 17.05.2018 09:27, Qu Wenruo wrote: >>> James Harvey reported that some corrupted compressed extent data can >>> lead to various kernel memory corruption. >>> >>> Such corrupted extent data belo

Re: [PATCH 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-17 Thread Qu Wenruo
On 2018年05月17日 16:14, Nikolay Borisov wrote: > > > On 17.05.2018 09:27, Qu Wenruo wrote: >> James Harvey reported that some corrupted compressed extent data can >> lead to various kernel memory corruption. >> >> Such corrupted extent data belongs to inode with NODATASUM flags, thus >> data csum

Re: [PATCH 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access

2018-05-17 Thread Nikolay Borisov
On 17.05.2018 09:27, Qu Wenruo wrote: > James Harvey reported that some corrupted compressed extent data can > lead to various kernel memory corruption. > > Such corrupted extent data belongs to inode with NODATASUM flags, thus > data csum won't help us detecting such bug. > > If lucky enough,