[PATCH v2] fs: btrfs: fix out of bounds write

[Tom Rini]

On Tue, Jun 25, 2024 at 01:22:01AM +0300, Alex ThreeD wrote:

> Hi all,
> 
> Is there something on my side needed to push this forward?

I will pick it up for -next in a while, thanks.

> 
> On Wed, Jun 19, 2024 at 12:41 AM Alex Shumsky <alexthreed at gmail.com> wrote:
> 
> > Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> > buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> > Previously this OOB write have not been noticed because distroboot usually
> > read files into huge static memory areas.
> >
> > Signed-off-by: Alex Shumsky <alexthreed at gmail.com>
> > Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
> > ---
> >
> > Changes in v2:
> > - fix error path handling
> > - add Fixes tag
> > - use min3
> >
> >  fs/btrfs/inode.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> > index 4691612eda..3998ffc2c8 100644
> > --- a/fs/btrfs/inode.c
> > +++ b/fs/btrfs/inode.c
> > @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> >         extent_type = btrfs_file_extent_type(leaf, fi);
> >         if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> >                 ret = btrfs_read_extent_inline(path, fi, buf);
> > -               memcpy(dest, buf + page_off, min(page_len, ret));
> > +               if (ret < 0) {
> > +                       free(buf);
> > +                       return ret;
> > +               }
> > +               memcpy(dest, buf + page_off, min3(page_len, ret, len));
> >                 free(buf);
> >                 return len;
> >         }
> > @@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> >                 free(buf);
> >                 return ret;
> >         }
> > -       memcpy(dest, buf + page_off, page_len);
> > +       memcpy(dest, buf + page_off, min(page_len, len));
> >         free(buf);
> >         return len;
> >  }
> > --
> > 2.34.1
> >
> >

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20240624/33d85ec7/attachment.sig>