btrfs: check if there is space for chunk item when validating sys chunk array

We checked if have enough remaining space for a key before dereferencing a
key, but we then dereference a chunk item, to get the number of stripes,
without checking if there is space for the item. So add a check to see if
there is enough space for a chunk item before dereferencing the item to
extract the stripe count.

Fixes: 2a9bb78cfd36 ("btrfs: validate system chunk array at btrfs_validate_super()")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index a1d83ad9a4c00cb0bb481e1262797e2642d5eeb5..94a7e9059a7b3f90e6e69a29617c104e952f710e 100644 (file)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2370,6 +2370,10 @@ static int validate_sys_chunk_array(const struct btrfs_fs_info *fs_info,
                                  key.type, cur);
                        return -EUCLEAN;
                }
+
+               if (unlikely(cur + sizeof(*chunk) > sys_array_size))
+                       goto short_read;
+
                chunk = (struct btrfs_chunk *)(sb->sys_chunk_array + cur);
                num_stripes = btrfs_stack_chunk_num_stripes(chunk);
                if (unlikely(cur + btrfs_chunk_item_size(num_stripes) > sys_array_size))