Skip to content
Snippets Groups Projects
  • Darren Kenny's avatar
    589500ad
    fs/btrfs: Fix more fuzz issues related to chunks · 589500ad
    Darren Kenny authored
    
    The corpus was generating issues in grub_btrfs_read_logical() when
    attempting to iterate over stripe entries in the superblock's
    bootmapping.
    
    In most cases the reason for the failure was that the number of stripes
    in chunk->nstripes exceeded the possible space statically allocated in
    superblock bootmapping space. Each stripe entry in the bootmapping block
    consists of a grub_btrfs_key followed by a grub_btrfs_chunk_stripe.
    
    Another issue that came up was that while calculating the chunk size,
    in an earlier piece of code in that function, depending on the data
    provided in the btrfs file system, it would end up calculating a size
    that was too small to contain even 1 grub_btrfs_chunk_item, which is
    obviously invalid too.
    
    Signed-off-by: default avatarDarren Kenny <darren.kenny@oracle.com>
    Reviewed-by: default avatarDaniel Kiper <daniel.kiper@oracle.com>
    589500ad
    History
    fs/btrfs: Fix more fuzz issues related to chunks
    Darren Kenny authored
    
    The corpus was generating issues in grub_btrfs_read_logical() when
    attempting to iterate over stripe entries in the superblock's
    bootmapping.
    
    In most cases the reason for the failure was that the number of stripes
    in chunk->nstripes exceeded the possible space statically allocated in
    superblock bootmapping space. Each stripe entry in the bootmapping block
    consists of a grub_btrfs_key followed by a grub_btrfs_chunk_stripe.
    
    Another issue that came up was that while calculating the chunk size,
    in an earlier piece of code in that function, depending on the data
    provided in the btrfs file system, it would end up calculating a size
    that was too small to contain even 1 grub_btrfs_chunk_item, which is
    obviously invalid too.
    
    Signed-off-by: default avatarDarren Kenny <darren.kenny@oracle.com>
    Reviewed-by: default avatarDaniel Kiper <daniel.kiper@oracle.com>