Re: [PATCH] btrfs: lzo: reject inline extents without both headers

[Qu Wenruo]

在 2026/7/14 16:40, David Lee 写道:
> inline Btrfs LZO payload shorter than two LZO headers.
>
> Fix the validation or lifetime rule at the vulnerable boundary so malformed
> or racing input cannot reach the faulting path.
>
> Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>
> Assisted-by: Codex:gpt-5.5
> ---
> Trail of Bits has a reproducer for this bug demonstrating Kernel Panic which can be shared further if needed.
>
> fs/btrfs/lzo.c |    3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c
> --- a/fs/btrfs/lzo.c
> +++ b/fs/btrfs/lzo.c
> @@ -552,7 +552,8 @@ int lzo_decompress(struct list_head *ws, const u8 *data_in,
>   	size_t max_segment_len = workspace_buf_length(fs_info);
>   	int ret;
>   
> -	if (unlikely(srclen < LZO_LEN || srclen > max_segment_len + LZO_LEN * 2))
> +	if (unlikely(srclen < LZO_LEN * 2 ||

srclen == LZO_LEN * 2 is also invalid, as that means the lzo payload is 
empty.


Also your base is a little too old.

The latest for-next branch has extra error messages, thus your patch 
doesn't apply cleanly.

Please rebase to the latest for-next branch:

 https://github.com/btrfs/linux.git for-next

Otherwise the fix looks good to me.

Thanks,
Qu

> +		     srclen > max_segment_len + LZO_LEN * 2))
>   		return -EUCLEAN;
>   
>   	in_len = get_unaligned_le32(data_in);