On Tue, Jun 25, 2024 at 01:22:01AM +0300, Alex ThreeD wrote: > Hi all, > > Is there something on my side needed to push this forward?
I will pick it up for -next in a while, thanks.
>
> On Wed, Jun 19, 2024 at 12:41 AM Alex Shumsky <alexthr...@gmail.com> wrote:
>
> > Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> > buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> > Previously this OOB write have not been noticed because distroboot usually
> > read files into huge static memory areas.
> >
> > Signed-off-by: Alex Shumsky <alexthr...@gmail.com>
> > Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
> > ---
> >
> > Changes in v2:
> > - fix error path handling
> > - add Fixes tag
> > - use min3
> >
> > fs/btrfs/inode.c | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> > index 4691612eda..3998ffc2c8 100644
> > --- a/fs/btrfs/inode.c
> > +++ b/fs/btrfs/inode.c
> > @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> > extent_type = btrfs_file_extent_type(leaf, fi);
> > if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> > ret = btrfs_read_extent_inline(path, fi, buf);
> > - memcpy(dest, buf + page_off, min(page_len, ret));
> > + if (ret < 0) {
> > + free(buf);
> > + return ret;
> > + }
> > + memcpy(dest, buf + page_off, min3(page_len, ret, len));
> > free(buf);
> > return len;
> > }
> > @@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> > free(buf);
> > return ret;
> > }
> > - memcpy(dest, buf + page_off, page_len);
> > + memcpy(dest, buf + page_off, min(page_len, len));
> > free(buf);
> > return len;
> > }
> > --
> > 2.34.1
> >
> >
--
Tom
signature.asc
Description: PGP signature
