]> git.ipfire.org Git - thirdparty/grub.git/commit
fs/btrfs: Fix more fuzz issues related to chunks
authorDarren Kenny <darren.kenny@oracle.com>
Thu, 7 Apr 2022 15:18:12 +0000 (15:18 +0000)
committerDaniel Kiper <daniel.kiper@oracle.com>
Tue, 7 Jun 2022 14:39:34 +0000 (16:39 +0200)
commit2f4430cc0a44fd8c8aa7aee5c51887667ad3d6c3
tree09f904c91164220403bd1858fb5eb203f44f4818
parent13dce204cf6f3f0f49c9949971052a4c9657c0c0
fs/btrfs: Fix more fuzz issues related to chunks

The corpus was generating issues in grub_btrfs_read_logical() when
attempting to iterate over stripe entries in the superblock's
bootmapping.

In most cases the reason for the failure was that the number of stripes
in chunk->nstripes exceeded the possible space statically allocated in
superblock bootmapping space. Each stripe entry in the bootmapping block
consists of a grub_btrfs_key followed by a grub_btrfs_chunk_stripe.

Another issue that came up was that while calculating the chunk size,
in an earlier piece of code in that function, depending on the data
provided in the btrfs file system, it would end up calculating a size
that was too small to contain even 1 grub_btrfs_chunk_item, which is
obviously invalid too.

Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/fs/btrfs.c