[PATCH v2] btrfs: Fix divide by zero

[PATCH v2] btrfs: Fix divide by zero

[Daniel Xu]

If there's no parity and num_stripes < ncopies, an btrfs image can
trigger a divide by zero in calc_stripe_length().

The image (see link) was generated through fuzzing.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209587
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
---

v1->v2:
* Upload test image to kernel bugzilla


 fs/btrfs/tree-checker.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index 7b1fee630f97..e03c3807921f 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -760,18 +760,36 @@ int btrfs_check_chunk_valid(struct extent_buffer *leaf,
 	u64 type;
 	u64 features;
 	bool mixed = false;
+	int raid_index;
+	int nparity;
+	int ncopies;
 
 	length = btrfs_chunk_length(leaf, chunk);
 	stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
 	num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
 	sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
 	type = btrfs_chunk_type(leaf, chunk);
+	raid_index = btrfs_bg_flags_to_raid_index(type);
+	ncopies = btrfs_raid_array[raid_index].ncopies;
+	nparity = btrfs_raid_array[raid_index].nparity;
 
 	if (!num_stripes) {
 		chunk_err(leaf, chunk, logical,
 			  "invalid chunk num_stripes, have %u", num_stripes);
 		return -EUCLEAN;
 	}
+	if (num_stripes < ncopies) {
+		chunk_err(leaf, chunk, logical,
+			  "invalid chunk num_stripes < ncopies, have %u < %d",
+			  num_stripes, ncopies);
+		return -EUCLEAN;
+	}
+	if (nparity && num_stripes == nparity) {
+		chunk_err(leaf, chunk, logical,
+			  "invalid chunk num_stripes == nparity, have %u == %d",
+			  num_stripes, nparity);
+		return -EUCLEAN;
+	}
 	if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
 		chunk_err(leaf, chunk, logical,
 		"invalid chunk logical, have %llu should aligned to %u",
-- 
2.28.0

Re: [PATCH v2] btrfs: Fix divide by zero

[Daniel Xu]

On Thu, Oct 8, 2020, at 6:09 PM, Daniel Xu wrote:
> If there's no parity and num_stripes < ncopies, an btrfs image can
> trigger a divide by zero in calc_stripe_length().
> 
> The image (see link) was generated through fuzzing.
> 
> Reviewed-by: Qu Wenruo <wqu@suse.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=209587
> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
> ---
> 
> v1->v2:
> * Upload test image to kernel bugzilla
> 
> 
>  fs/btrfs/tree-checker.c | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
> index 7b1fee630f97..e03c3807921f 100644
> --- a/fs/btrfs/tree-checker.c
> +++ b/fs/btrfs/tree-checker.c
> @@ -760,18 +760,36 @@ int btrfs_check_chunk_valid(struct extent_buffer *leaf,
>  	u64 type;
>  	u64 features;
>  	bool mixed = false;
> +	int raid_index;
> +	int nparity;
> +	int ncopies;
>  
>  	length = btrfs_chunk_length(leaf, chunk);
>  	stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
>  	num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
>  	sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
>  	type = btrfs_chunk_type(leaf, chunk);
> +	raid_index = btrfs_bg_flags_to_raid_index(type);
> +	ncopies = btrfs_raid_array[raid_index].ncopies;
> +	nparity = btrfs_raid_array[raid_index].nparity;
>  
>  	if (!num_stripes) {
>  		chunk_err(leaf, chunk, logical,
>  			  "invalid chunk num_stripes, have %u", num_stripes);
>  		return -EUCLEAN;
>  	}
> +	if (num_stripes < ncopies) {
> +		chunk_err(leaf, chunk, logical,
> +			  "invalid chunk num_stripes < ncopies, have %u < %d",
> +			  num_stripes, ncopies);
> +		return -EUCLEAN;
> +	}
> +	if (nparity && num_stripes == nparity) {
> +		chunk_err(leaf, chunk, logical,
> +			  "invalid chunk num_stripes == nparity, have %u == %d",
> +			  num_stripes, nparity);
> +		return -EUCLEAN;
> +	}
>  	if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
>  		chunk_err(leaf, chunk, logical,
>  		"invalid chunk logical, have %llu should aligned to %u",
> -- 
> 2.28.0
> 
>

Gentle poke.

Thanks,
Daniel

Re: [PATCH v2] btrfs: Fix divide by zero

[Josef Bacik]

On 10/8/20 9:09 PM, Daniel Xu wrote:
> If there's no parity and num_stripes < ncopies, an btrfs image can
> trigger a divide by zero in calc_stripe_length().
> 
> The image (see link) was generated through fuzzing.
> 
> Reviewed-by: Qu Wenruo <wqu@suse.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=209587
> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
>

Reviewed-by: Josef Bacik <josef@toxicpanda.com>

Thanks,

Josef

Re: [PATCH v2] btrfs: Fix divide by zero

[David Sterba]

On Thu, Oct 08, 2020 at 06:09:10PM -0700, Daniel Xu wrote:
> If there's no parity and num_stripes < ncopies, an btrfs image can
> trigger a divide by zero in calc_stripe_length().
> 
> The image (see link) was generated through fuzzing.
> 
> Reviewed-by: Qu Wenruo <wqu@suse.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=209587

For bugzillas please use Bugzilla: tag.

> Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>

Please write more descriptive subjects like

"btrfs: tree-checker: validate number of chunk stripes and parity"