All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Sterba <dsterba@suse.cz>
To: Qu Wenruo <wqu@suse.com>
Cc: linux-btrfs@vger.kernel.org
Subject: Re: [PATCH v3 0/4] btrfs: lzo: Harden decompression callers to avoid kernel memory corruption.
Date: Thu, 24 May 2018 19:19:27 +0200	[thread overview]
Message-ID: <20180524171927.GI6649@twin.jikos.cz> (raw)
In-Reply-To: <20180523082301.29874-1-wqu@suse.com>

On Wed, May 23, 2018 at 04:22:57PM +0800, Qu Wenruo wrote:
> James Harvey reported pretty strange kernel misbehavior where after
> reading certain btrfs compressed data, kernel crash with unrelated
> calltrace.
> (https://bugzilla.kernel.org/show_bug.cgi?id=199707 and
>  https://www.spinics.net/lists/linux-btrfs/msg77971.html)
...
> Thanks for his comprehensive debug help, we located the problem to:
> 
> v3:
>   Fix comment error for inlined lzo compressed extent. (Still has
>   header), thanks David for pointing this out.
>   Add example ascii graph as an example.
>   Enhance inlined extent check, as header length must match with segment
>   header length + LZO_LEN * 2.
> 
> Qu Wenruo (4):
>   btrfs: compression: Add linux/sizes.h for compression.h
>   btrfs: lzo: Add comment about the how btrfs records its lzo compressed
>     data
>   btrfs: lzo: Add header length check to avoid slab out of bounds access
>   btrfs: lzo: Harden inline lzo compressed extent decompression

Thanks, added to misc-next. I left the wost compression estimate in the
local variable, only added a const to it. Zlib and zstd are using a
different compression container format but some of the check might apply
there too, I haven't looked closer.

      parent reply	other threads:[~2018-05-24 17:22 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-23  8:22 [PATCH v3 0/4] btrfs: lzo: Harden decompression callers to avoid kernel memory corruption Qu Wenruo
2018-05-23  8:22 ` [PATCH v3 1/4] btrfs: compression: Add linux/sizes.h for compression.h Qu Wenruo
2018-05-23  8:22 ` [PATCH v3 2/4] btrfs: lzo: Add comment about the how btrfs records its lzo compressed data Qu Wenruo
2018-05-23  8:23 ` [PATCH v3 3/4] btrfs: lzo: Add header length check to avoid slab out of bounds access Qu Wenruo
2018-05-24  2:09   ` Misono Tomohiro
2018-05-24  4:01     ` Qu Wenruo
2018-05-29  8:30   ` Misono Tomohiro
2018-05-29  8:51     ` Qu Wenruo
2018-05-30  4:58   ` [PATCH v4 " Qu Wenruo
2018-05-30  5:14     ` Misono Tomohiro
2018-05-30 14:47     ` David Sterba
2018-05-23  8:23 ` [PATCH v3 4/4] btrfs: lzo: Harden inline lzo compressed extent decompression Qu Wenruo
2018-05-24 17:19 ` David Sterba [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180524171927.GI6649@twin.jikos.cz \
    --to=dsterba@suse.cz \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=wqu@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.