From nobody Sat Jul 25 20:05:58 2026 Received: from mail-qk1-f172.google.com (mail-qk1-f172.google.com [209.85.222.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC65A3DE425 for ; Tue, 14 Jul 2026 07:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784013059; cv=none; b=jnWPoBtUs7uQSbybmfjFcS8EtNvxk9X9N1QUYSE/A3XfKtoUgzM27AoN18NKV2qm034tFSzGORddfLFage+PMOPwdntNSP2/iR8GlaWl8Ben451dhnNTFIirzuMZG9BFBouoiymC0oZUT7W5OL3SLVOXOFfZJg358n9vHWqjdLQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784013059; c=relaxed/simple; bh=3EpYSZdglM9uMM9UNZN2Sb6Hl5n0KYaJohBNLrcZLAQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SZjBRmsyK7HMg/lAB5ENva3t2kcL57rdmpmxTEzZvyG9BLlCylx0/7rU007tcvrfnbAvoHgwQylSfUzHYpoVunn58ALyguNyOsB73IcTMJ+4mUdlToJlYPnCMTBEYq6wtG+29fgvyd4Nyfh+OS3LkzJbUPlT/BbA95Bo0GG6ZVQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=MJnnuJUq; arc=none smtp.client-ip=209.85.222.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="MJnnuJUq" Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-9217d13c276so250567885a.1 for ; Tue, 14 Jul 2026 00:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784013056; x=1784617856; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pmblTb+Aw5bk825UZTwA8Gbxpnmr5LndhwgKr3cl2yE=; b=MJnnuJUqph2XUXfF06oXMjKt0vlEvhXoQhkq8Fjfhvq1rrzEPwJDvSNd9lUzUFuAIr xGYg+YhM2LiwEP5YkFf3FU1HpNjYFOg1rcjNvS+08IZ0zmY7sPhJyOsZjPgJWVYAVr5m mteHVXnTffNqPoKM0OvFaAn3tBgGEo74A63cAfO+Zl22Ojf6TfAmAeQUNrCnxne6WLyG oY67kCPT2nlZQRYqLzvKyQnaHaFu+E/IZuLtLl1kV3f8fJtDFwvyCWAxnknsoGMchzzs GjWyge4MLXeqoOvg/7ODUw2rWRxnP2VR88a8t55rfvWNZQBFafaj7UF19hQRtxNLWThb bCSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784013056; x=1784617856; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pmblTb+Aw5bk825UZTwA8Gbxpnmr5LndhwgKr3cl2yE=; b=WppgxOQRygpGU9OzPHPXTi+vbn0uKNC5yArypidFzsFw9N5gpE3IQPeHGWwVeNrWTq e5yB6TemWMRmkYxdKm9mh86J1s/r+5A7RKCjDb5LyuDJSu3aP0uqEV1Y4QY8cyiNJ1Bl lzjtchoqKZkfI0F+SsPuOo75j30V30+qM1ycdbF71sKKQrnd8wDryQ9R3ISBvg4c25d4 e2LiW4SwNF4jWHodCWZ81eFKEpm6PBxJxiwIrekaiH7MatwBRJMmIwwkEE655TtvE42x T+R2Yu5Q52QzK7AKbteuW4As1J9j7ItLP7O5iByoZFtijLR6LK5/2D7iFi+onu6JK/lt QkCA== X-Forwarded-Encrypted: i=1; AHgh+RryKAHVLCd0SeBoQbdgwfz28ejbTr4XBYK67FU6NZeA4+x0amkcFHCcOKw3Q2u78fL7PeyZEDilBXE8G+o=@vger.kernel.org X-Gm-Message-State: AOJu0Yy/AK7+CkknvRlzlYy+1qTopGsfFxhWCVDvXMn6CHQL6iGcDymL u186eSSfiBNf5NEW0QPA6BjDRZLvLLUZAvHs9sk1Z7vXUkOreTerFubHNBelHrudb88= X-Gm-Gg: AfdE7cntFVEzD2N+bR2OVDiORGDhRHQpDu0pe/BkxTWhtcoZkYFb7P4LiaQxvi9y1/h rHkN6fU5A3rxB3LkBpwS7nT/+jjDQcc98yBi9vWAtNyTuKfCjSaKge/XSc/os1BErohctexW/9r 1N8TNotaqJnMgpgwJxgbVG4eX3N5e3183c7o/+xE8efwQhTIhRf4FxK/5cZGAVx58i6FsFFnIdh y/mO5vuznBzg5lqVycvsofg5WR+m6C0ltfertM7XJXmleeYMYp7k1nea7l4S2E0exeekOV72NzT 6UwYlgEzwFuGRETnR6L12+zfwWap1W9IXJa9GrddpUBmoegPRPq7l9sgsJGNncyFyHOSqtYS6wb 4WFRmzIwPebnIqBB3IPm/yUjNIxOGWklQIDmSyBObLvgwOqHfRRDIBBIuAkO6zaKLaKYDQ8YjYg jGRXLyYN5ERa8vkvfeIA== X-Received: by 2002:a05:620a:461e:b0:92e:f33f:f45b with SMTP id af79cd13be357-93083ddfed2mr219179485a.84.1784013056527; Tue, 14 Jul 2026 00:10:56 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-92ee5bb3542sm1322488585a.20.2026.07.14.00.10.56 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 14 Jul 2026 00:10:56 -0700 (PDT) From: David Lee To: Chris Mason Cc: David Lee , David Sterba , Dominik 'Disconnect3d' Czarnota , linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] btrfs: lzo: reject inline extents without both headers Date: Tue, 14 Jul 2026 07:10:52 +0000 Message-ID: <20260714071054.1715464-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" inline Btrfs LZO payload shorter than two LZO headers. Fix the validation or lifetime rule at the vulnerable boundary so malformed or racing input cannot reach the faulting path. Signed-off-by: David Lee Assisted-by: Codex:gpt-5.5 --- Trail of Bits has a reproducer for this bug demonstrating Kernel Panic whic= h can be shared further if needed. fs/btrfs/lzo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c --- a/fs/btrfs/lzo.c +++ b/fs/btrfs/lzo.c @@ -552,7 +552,8 @@ int lzo_decompress(struct list_head *ws, const u8 *data= _in, size_t max_segment_len =3D workspace_buf_length(fs_info); int ret; =20 - if (unlikely(srclen < LZO_LEN || srclen > max_segment_len + LZO_LEN * 2)) + if (unlikely(srclen < LZO_LEN * 2 || + srclen > max_segment_len + LZO_LEN * 2)) return -EUCLEAN; =20 in_len =3D get_unaligned_le32(data_in);