From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f172.google.com (mail-qk1-f172.google.com [209.85.222.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC65A3DE425 for ; Tue, 14 Jul 2026 07:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784013059; cv=none; b=jnWPoBtUs7uQSbybmfjFcS8EtNvxk9X9N1QUYSE/A3XfKtoUgzM27AoN18NKV2qm034tFSzGORddfLFage+PMOPwdntNSP2/iR8GlaWl8Ben451dhnNTFIirzuMZG9BFBouoiymC0oZUT7W5OL3SLVOXOFfZJg358n9vHWqjdLQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784013059; c=relaxed/simple; bh=3EpYSZdglM9uMM9UNZN2Sb6Hl5n0KYaJohBNLrcZLAQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SZjBRmsyK7HMg/lAB5ENva3t2kcL57rdmpmxTEzZvyG9BLlCylx0/7rU007tcvrfnbAvoHgwQylSfUzHYpoVunn58ALyguNyOsB73IcTMJ+4mUdlToJlYPnCMTBEYq6wtG+29fgvyd4Nyfh+OS3LkzJbUPlT/BbA95Bo0GG6ZVQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=MJnnuJUq; arc=none smtp.client-ip=209.85.222.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="MJnnuJUq" Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-9217d13c276so250567885a.1 for ; Tue, 14 Jul 2026 00:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784013056; x=1784617856; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pmblTb+Aw5bk825UZTwA8Gbxpnmr5LndhwgKr3cl2yE=; b=MJnnuJUqph2XUXfF06oXMjKt0vlEvhXoQhkq8Fjfhvq1rrzEPwJDvSNd9lUzUFuAIr xGYg+YhM2LiwEP5YkFf3FU1HpNjYFOg1rcjNvS+08IZ0zmY7sPhJyOsZjPgJWVYAVr5m mteHVXnTffNqPoKM0OvFaAn3tBgGEo74A63cAfO+Zl22Ojf6TfAmAeQUNrCnxne6WLyG oY67kCPT2nlZQRYqLzvKyQnaHaFu+E/IZuLtLl1kV3f8fJtDFwvyCWAxnknsoGMchzzs GjWyge4MLXeqoOvg/7ODUw2rWRxnP2VR88a8t55rfvWNZQBFafaj7UF19hQRtxNLWThb bCSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784013056; x=1784617856; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pmblTb+Aw5bk825UZTwA8Gbxpnmr5LndhwgKr3cl2yE=; b=WppgxOQRygpGU9OzPHPXTi+vbn0uKNC5yArypidFzsFw9N5gpE3IQPeHGWwVeNrWTq e5yB6TemWMRmkYxdKm9mh86J1s/r+5A7RKCjDb5LyuDJSu3aP0uqEV1Y4QY8cyiNJ1Bl lzjtchoqKZkfI0F+SsPuOo75j30V30+qM1ycdbF71sKKQrnd8wDryQ9R3ISBvg4c25d4 e2LiW4SwNF4jWHodCWZ81eFKEpm6PBxJxiwIrekaiH7MatwBRJMmIwwkEE655TtvE42x T+R2Yu5Q52QzK7AKbteuW4As1J9j7ItLP7O5iByoZFtijLR6LK5/2D7iFi+onu6JK/lt QkCA== X-Forwarded-Encrypted: i=1; AHgh+RryKAHVLCd0SeBoQbdgwfz28ejbTr4XBYK67FU6NZeA4+x0amkcFHCcOKw3Q2u78fL7PeyZEDilBXE8G+o=@vger.kernel.org X-Gm-Message-State: AOJu0Yy/AK7+CkknvRlzlYy+1qTopGsfFxhWCVDvXMn6CHQL6iGcDymL u186eSSfiBNf5NEW0QPA6BjDRZLvLLUZAvHs9sk1Z7vXUkOreTerFubHNBelHrudb88= X-Gm-Gg: AfdE7cntFVEzD2N+bR2OVDiORGDhRHQpDu0pe/BkxTWhtcoZkYFb7P4LiaQxvi9y1/h rHkN6fU5A3rxB3LkBpwS7nT/+jjDQcc98yBi9vWAtNyTuKfCjSaKge/XSc/os1BErohctexW/9r 1N8TNotaqJnMgpgwJxgbVG4eX3N5e3183c7o/+xE8efwQhTIhRf4FxK/5cZGAVx58i6FsFFnIdh y/mO5vuznBzg5lqVycvsofg5WR+m6C0ltfertM7XJXmleeYMYp7k1nea7l4S2E0exeekOV72NzT 6UwYlgEzwFuGRETnR6L12+zfwWap1W9IXJa9GrddpUBmoegPRPq7l9sgsJGNncyFyHOSqtYS6wb 4WFRmzIwPebnIqBB3IPm/yUjNIxOGWklQIDmSyBObLvgwOqHfRRDIBBIuAkO6zaKLaKYDQ8YjYg jGRXLyYN5ERa8vkvfeIA== X-Received: by 2002:a05:620a:461e:b0:92e:f33f:f45b with SMTP id af79cd13be357-93083ddfed2mr219179485a.84.1784013056527; Tue, 14 Jul 2026 00:10:56 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-92ee5bb3542sm1322488585a.20.2026.07.14.00.10.56 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 14 Jul 2026 00:10:56 -0700 (PDT) From: David Lee To: Chris Mason Cc: David Lee , David Sterba , Dominik 'Disconnect3d' Czarnota , linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] btrfs: lzo: reject inline extents without both headers Date: Tue, 14 Jul 2026 07:10:52 +0000 Message-ID: <20260714071054.1715464-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit inline Btrfs LZO payload shorter than two LZO headers. Fix the validation or lifetime rule at the vulnerable boundary so malformed or racing input cannot reach the faulting path. Signed-off-by: David Lee Assisted-by: Codex:gpt-5.5 --- Trail of Bits has a reproducer for this bug demonstrating Kernel Panic which can be shared further if needed. fs/btrfs/lzo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c --- a/fs/btrfs/lzo.c +++ b/fs/btrfs/lzo.c @@ -552,7 +552,8 @@ int lzo_decompress(struct list_head *ws, const u8 *data_in, size_t max_segment_len = workspace_buf_length(fs_info); int ret; - if (unlikely(srclen < LZO_LEN || srclen > max_segment_len + LZO_LEN * 2)) + if (unlikely(srclen < LZO_LEN * 2 || + srclen > max_segment_len + LZO_LEN * 2)) return -EUCLEAN; in_len = get_unaligned_le32(data_in);