Repository navigation
btrfs: fix integer overflow in bd_btrfs_create_volume argument counter - #1218
Conversation
bd_btrfs_create_volume() used guint8 for both num_args and next_arg when constructing the mkfs.btrfs argv array. When the number of input devices combined with optional parameters (label, data_level, md_level) exceeded 255, the 8-bit counter wrapped around to a much smaller value, causing g_new0() to allocate a buffer far too small for the actual number of arguments. The subsequent argv population then wrote past the allocated boundary, corrupting heap metadata and potentially leading to arbitrary code execution. Fix it by widening num_args and next_arg from guint8 to guint, which provides a 32-bit range sufficient for any realistic argument count. Signed-off-by: Kou Wenqi <kouwenqi@kylinos.cn>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title names the btrfs fix and the function involved, bd_btrfs_create_volume. The PR changes the argument counter and index from guint8 to guint, which prevents wrap-around when devices and options… |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the btrfs fix and the function involved, bd_btrfs_create_volume. The PR changes the argument counter and index from guint8 to guint, which prevents wrap-around when devices and options exceed 255. The title calls this an integer overflow in the argument counter. The changeset matches this description. The title does not mention the 255 limit or the buffer under-allocation, but it covers the main change.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
Jenkins, ok to test. |
6cef17e
into
storaged-project:master
bd_btrfs_create_volume() used guint8 for both num_args and next_arg when constructing the mkfs.btrfs argv array. When the number of input devices combined with optional parameters (label, data_level, md_level) exceeded 255, the 8-bit counter wrapped around to a much smaller value, causing g_new0() to allocate a buffer far too small for the actual number of arguments. The subsequent argv population then wrote past the allocated boundary, corrupting heap metadata and potentially leading to arbitrary code execution.
Fix it by widening num_args and next_arg from guint8 to guint, which provides a 32-bit range sufficient for any realistic argument count.
Summary by CodeRabbit