Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 298499d7 authored by Nikolay Borisov's avatar Nikolay Borisov Committed by Greg Kroah-Hartman
Browse files

btrfs: promote debugging asserts to full-fledged checks in validate_super 



commit aefd7f7065567a4666f42c0fc8cdb379d2e036bf upstream.

Syzbot managed to trigger this assert while performing its fuzzing.
Turns out it's better to have those asserts turned into full-fledged
checks so that in case buggy btrfs images are mounted the users gets
an error and mounting is stopped. Alternatively with CONFIG_BTRFS_ASSERT
disabled such image would have been erroneously allowed to be mounted.

Reported-by: default avatar <syzbot+a6bf271c02e4fe66b4e4@syzkaller.appspotmail.com>
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: default avatarQu Wenruo <wqu@suse.com>
Signed-off-by: default avatarNikolay Borisov <nborisov@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
[ add uuids to the messages ]
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d4b04765

fs/btrfs/disk-io.c

+18 −8
Original line number Diff line number Diff line
@@ -2463,6 +2463,24 @@ static int validate_super(struct btrfs_fs_info *fs_info, 
		ret = -EINVAL;

	}



	if (memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid,

		   BTRFS_FSID_SIZE)) {

		btrfs_err(fs_info,

		"superblock fsid doesn't match fsid of fs_devices: %pU != %pU",

			fs_info->super_copy->fsid, fs_info->fs_devices->fsid);

		ret = -EINVAL;

	}



	if (btrfs_fs_incompat(fs_info, METADATA_UUID) &&

	    memcmp(fs_info->fs_devices->metadata_uuid,

		   fs_info->super_copy->metadata_uuid, BTRFS_FSID_SIZE)) {

		btrfs_err(fs_info,

"superblock metadata_uuid doesn't match metadata uuid of fs_devices: %pU != %pU",

			fs_info->super_copy->metadata_uuid,

			fs_info->fs_devices->metadata_uuid);

		ret = -EINVAL;

	}



	if (memcmp(fs_info->fs_devices->metadata_uuid, sb->dev_item.fsid,

		   BTRFS_FSID_SIZE) != 0) {

		btrfs_err(fs_info,
@@ -2837,14 +2855,6 @@ int open_ctree(struct super_block *sb, 


	disk_super = fs_info->super_copy;



	ASSERT(!memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid,

		       BTRFS_FSID_SIZE));



	if (btrfs_fs_incompat(fs_info, METADATA_UUID)) {

		ASSERT(!memcmp(fs_info->fs_devices->metadata_uuid,

				fs_info->super_copy->metadata_uuid,

				BTRFS_FSID_SIZE));

	}



	features = btrfs_super_flags(disk_super);

	if (features & BTRFS_SUPER_FLAG_CHANGING_FSID_V2) {