* [PATCH v2] btrfs-progs: Fix a buffer overflow causing segfault in fstests/btrfs/069
@ 2015-01-06 9:30 Qu Wenruo
0 siblings, 0 replies; only message in thread
From: Qu Wenruo @ 2015-01-06 9:30 UTC (permalink / raw)
To: linux-btrfs
The newly introduced search_chunk_tree_for_fs_info() won't count devid 0
in fi_arg->num_devices, which will cause buffer overflow since later
get_device_info() will fill di_args with devid.
This can be trigger by fstests/btrfs/069 and any operations needs to
iterate over all the devices like 'fi show' or 'dev stat' while
replacing.
The fix is do an extra probe specifically for devid 0 after
search_chunk_tree_for_fs_info() and change num_devices if needed.
Reported-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com>
Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Signed-off-by: Gui Hecheng <guihc.fnst@cn.fujitsu.com>
---
utils.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/utils.c b/utils.c
index af0a8fe..6581568 100644
--- a/utils.c
+++ b/utils.c
@@ -1934,8 +1934,10 @@ int get_fs_info(char *path, struct btrfs_ioctl_fs_info_args *fi_args,
int ret = 0;
int ndevs = 0;
int i = 0;
+ int replacing = 0;
struct btrfs_fs_devices *fs_devices_mnt = NULL;
struct btrfs_ioctl_dev_info_args *di_args;
+ struct btrfs_ioctl_dev_info_args tmp;
char mp[BTRFS_PATH_NAME_MAX + 1];
DIR *dirstream = NULL;
@@ -2003,6 +2005,19 @@ int get_fs_info(char *path, struct btrfs_ioctl_fs_info_args *fi_args,
ret = search_chunk_tree_for_fs_info(fd, fi_args);
if (ret)
goto out;
+
+ /*
+ * search_chunk_tree_for_fs_info() will lacks the devid 0
+ * so manual probe for it here.
+ */
+ ret = get_device_info(fd, 0, &tmp);
+ if (!ret) {
+ fi_args->num_devices++;
+ ndevs++;
+ replacing = 1;
+ if (i == 0)
+ i++;
+ }
}
if (!fi_args->num_devices)
@@ -2014,6 +2029,8 @@ int get_fs_info(char *path, struct btrfs_ioctl_fs_info_args *fi_args,
goto out;
}
+ if (replacing)
+ memcpy(di_args, &tmp, sizeof(tmp));
for (; i <= fi_args->max_id; ++i) {
ret = get_device_info(fd, i, &di_args[ndevs]);
if (ret == -ENODEV)
--
2.2.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-01-06 9:30 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-06 9:30 [PATCH v2] btrfs-progs: Fix a buffer overflow causing segfault in fstests/btrfs/069 Qu Wenruo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.