diff options
| author | Su Yue <suy.fnst@cn.fujitsu.com> | 2017-06-06 11:57:06 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2017-06-21 19:16:04 +0200 |
| commit | 488d7c4566536b8807381bc54e559fd43decd26a (patch) | |
| tree | 0eff37754ed219cd199abb743083499983749336 | |
| parent | btrfs: Check name_len before read in iterate_dir_item (diff) | |
| download | linux-488d7c4566536b8807381bc54e559fd43decd26a.tar.xz linux-488d7c4566536b8807381bc54e559fd43decd26a.zip | |
btrfs: Check name_len before reading btrfs_get_name
In btrfs_get_name, there's btrfs_search_slot and reads name from
inode_ref/root_ref.
Call btrfs_is_name_len_valid in btrfs_get_name.
Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | fs/btrfs/export.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c index 87144c9f9593..fa66980726c9 100644 --- a/fs/btrfs/export.c +++ b/fs/btrfs/export.c @@ -282,6 +282,11 @@ static int btrfs_get_name(struct dentry *parent, char *name, name_len = btrfs_inode_ref_name_len(leaf, iref); } + ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len); + if (!ret) { + btrfs_free_path(path); + return -EIO; + } read_extent_buffer(leaf, name, name_ptr, name_len); btrfs_free_path(path); |