Commit ea1d1ca4 authored by Su Yue's avatar Su Yue Committed by David Sterba
Browse files

btrfs: tree-checker: check item_size for dev_item 



Check item size before accessing the device item to avoid out of bound
access, similar to inode_item check.

Signed-off-by: default avatarSu Yue <l@damenly.su>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 0c982944

fs/btrfs/tree-checker.c

+8 −0
Original line number Diff line number Diff line
@@ -965,6 +965,7 @@ static int check_dev_item(struct extent_buffer *leaf, 
			  struct btrfs_key *key, int slot)

{

	struct btrfs_dev_item *ditem;

	const u32 item_size = btrfs_item_size(leaf, slot);



	if (unlikely(key->objectid != BTRFS_DEV_ITEMS_OBJECTID)) {

		dev_item_err(leaf, slot,
@@ -972,6 +973,13 @@ static int check_dev_item(struct extent_buffer *leaf, 
			     key->objectid, BTRFS_DEV_ITEMS_OBJECTID);

		return -EUCLEAN;

	}



	if (unlikely(item_size != sizeof(*ditem))) {

		dev_item_err(leaf, slot, "invalid item size: has %u expect %zu",

			     item_size, sizeof(*ditem));

		return -EUCLEAN;

	}



	ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);

	if (unlikely(btrfs_device_id(leaf, ditem) != key->offset)) {

		dev_item_err(leaf, slot,