btrfs: lzo: Harden inline lzo compressed extent decompression (de885e3e) · Commits · 戴 / test

For inlined extent, we only have one segment, thus less things to check. And further more, inlined extent always has the csum in its leaf header, it's less probable to have corrupted data. Anyway, still check header and segment header. Signed-off-by:

Qu Wenruo <wqu@suse.com> Reviewed-by:

David Sterba <dsterba@suse.com> Signed-off-by:

David Sterba <dsterba@suse.com>

fs/btrfs/lzo.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -430,15 +430,24 @@ static int lzo_decompress(struct list_head ws, unsigned char data_in,
		struct workspace *workspace = list_entry(ws, struct workspace, list);
		size_t in_len;
		size_t out_len;
		size_t max_segment_len = lzo1x_worst_compress(PAGE_SIZE);
		int ret = 0;
		char *kaddr;
		unsigned long bytes;

		BUG_ON(srclen < LZO_LEN);
		if (srclen < LZO_LEN \|\| srclen > max_segment_len + LZO_LEN * 2)
		return -EUCLEAN;

		in_len = read_compress_length(data_in);
		if (in_len != srclen)
		return -EUCLEAN;
		data_in += LZO_LEN;

		in_len = read_compress_length(data_in);
		if (in_len != srclen - LZO_LEN * 2) {
		ret = -EUCLEAN;
		goto out;
		}
		data_in += LZO_LEN;

		out_len = PAGE_SIZE;

Admin message