linux-btrfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Omar Sandoval <osandov@osandov.com>
To: linux-btrfs@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org, kernel-team@fb.com
Subject: [PATCH v2 04/13] btrfs-progs: receive: support v2 send stream DATA tlv format
Date: Wed, 18 Nov 2020 11:18:49 -0800	[thread overview]
Message-ID: <514c65bbb59958b3e7504cadc3c708a48771d39b.1605723745.git.osandov@osandov.com> (raw)
In-Reply-To: <cover.1605723600.git.osandov@fb.com>

From: Boris Burkov <borisb@fb.com>

The new format privileges the BTRFS_SEND_A_DATA attribute by
guaranteeing it will always be the last attribute in any command that
needs it, and by implicitly encoding the data length as the difference
between the total command length in the command header and the sizes of
the rest of the attributes (and of course the tlv_type identifying the
DATA attribute). To parse the new stream, we must read the tlv_type and
if it is not DATA, we proceed normally, but if it is DATA, we don't
parse a tlv_len but simply compute the length.

In addition, we add some bounds checking when parsing each chunk of
data, as well as for the tlv_len itself.

Signed-off-by: Boris Burkov <boris@bur.io>
---
 common/send-stream.c | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/common/send-stream.c b/common/send-stream.c
index 51a6a94a..77d5cd04 100644
--- a/common/send-stream.c
+++ b/common/send-stream.c
@@ -165,28 +165,44 @@ static int read_cmd(struct btrfs_send_stream *sctx)
 
 	pos = 0;
 	while (pos < cmd_len) {
-		struct btrfs_tlv_header *tlv_hdr;
 		u16 tlv_type;
-		u16 tlv_len;
 		struct btrfs_send_attribute *send_attr;
 
-		tlv_hdr = (struct btrfs_tlv_header *)data;
-		tlv_type = le16_to_cpu(tlv_hdr->tlv_type);
-		tlv_len = le16_to_cpu(tlv_hdr->tlv_len);
+		if (cmd_len - pos < sizeof(__le16)) {
+			error("send stream is truncated");
+			ret = -EINVAL;
+			goto out;
+		}
+		tlv_type = le16_to_cpu(*(__le16 *)data);
 
 		if (tlv_type == 0 || tlv_type > BTRFS_SEND_A_MAX) {
-			error("invalid tlv in cmd tlv_type = %hu, tlv_len = %hu",
-					tlv_type, tlv_len);
+			error("invalid tlv in cmd tlv_type = %hu", tlv_type);
 			ret = -EINVAL;
 			goto out;
 		}
 
 		send_attr = &sctx->cmd_attrs[tlv_type];
 		send_attr->tlv_type = tlv_type;
-		send_attr->tlv_len = tlv_len;
-		pos += sizeof(*tlv_hdr);
-		data += sizeof(*tlv_hdr);
 
+		pos += sizeof(tlv_type);
+		data += sizeof(tlv_type);
+		if (sctx->version == 2 && tlv_type == BTRFS_SEND_A_DATA) {
+			send_attr->tlv_len = cmd_len - pos;
+		} else {
+			if (cmd_len - pos < sizeof(__le16)) {
+				error("send stream is truncated");
+				ret = -EINVAL;
+				goto out;
+			}
+			send_attr->tlv_len = le16_to_cpu(*(__le16 *)data);
+			pos += sizeof(__le16);
+			data += sizeof(__le16);
+		}
+		if (cmd_len - pos < send_attr->tlv_len) {
+			error("send stream is truncated");
+			ret = -EINVAL;
+			goto out;
+		}
 		send_attr->data = data;
 		pos += send_attr->tlv_len;
 		data += send_attr->tlv_len;
-- 
2.29.2


  parent reply	other threads:[~2020-11-18 19:19 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-18 19:18 [PATCH v2 0/5] btrfs: implement send/receive of compressed extents without decompressing Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 1/5] btrfs: add send stream v2 definitions Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 01/13] btrfs-progs: send: fix crash on unknown option Omar Sandoval
2020-12-16 16:20   ` David Sterba
2020-11-18 19:18 ` [PATCH v2 02/13] btrfs-progs: receive: support v2 send stream larger tlv_len Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 2/5] btrfs: send: write larger chunks when using stream v2 Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 03/13] btrfs-progs: receive: dynamically allocate sctx->read_buf Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 3/5] btrfs: send: allocate send buffer with alloc_page() and vmap() for v2 Omar Sandoval
2020-11-18 19:18 ` Omar Sandoval [this message]
2020-11-18 19:18 ` [PATCH v2 4/5] btrfs: send: send compressed extents with encoded writes Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 05/13] btrfs-progs: receive: add send stream v2 cmds and attrs to send.h Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 5/5] btrfs: send: enable support for stream v2 and compressed writes Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 06/13] btrfs-progs: receive: add stub implementation for pwritev2 Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 07/13] btrfs-progs: receive: open files with O_CLOEXEC Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 08/13] btrfs-progs: receive: process encoded_write commands Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 09/13] btrfs-progs: receive: encoded_write fallback to explicit decode and write Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 10/13] btrfs-progs: receive: process fallocate commands Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 11/13] btrfs-progs: receive: process setflags ioctl commands Omar Sandoval
2020-11-18 19:18 ` [PATCH v2 12/13] btrfs-progs: send: stream v2 ioctl flags Omar Sandoval
2020-11-18 19:19 ` [PATCH v2 13/13] btrfs-progs: receive: add tests for basic encoded_write send/receive Omar Sandoval

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=514c65bbb59958b3e7504cadc3c708a48771d39b.1605723745.git.osandov@osandov.com \
    --to=osandov@osandov.com \
    --cc=kernel-team@fb.com \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).