diff options
| author | Su Yue <suy.fnst@cn.fujitsu.com> | 2017-06-06 11:57:08 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2017-06-21 19:16:04 +0200 |
| commit | fbc326159a01104db6163bc8e5f0a4c0ab11864d (patch) | |
| tree | 3399e3bf0bcbb2a24fbea0818e1e9714833d117e /fs/btrfs | |
| parent | btrfs: Check name_len before in btrfs_del_root_ref (diff) | |
| download | linux-fbc326159a01104db6163bc8e5f0a4c0ab11864d.tar.xz linux-fbc326159a01104db6163bc8e5f0a4c0ab11864d.zip | |
btrfs: Verify dir_item in iterate_object_props
Call verify_dir_item before memcmp_extent_buffer reading name from
dir_item.
Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs')
| -rw-r--r-- | fs/btrfs/props.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c index d6cb155ef7a1..4b23ae5d0e5c 100644 --- a/fs/btrfs/props.c +++ b/fs/btrfs/props.c @@ -164,6 +164,7 @@ static int iterate_object_props(struct btrfs_root *root, size_t), void *ctx) { + struct btrfs_fs_info *fs_info = root->fs_info; int ret; char *name_buf = NULL; char *value_buf = NULL; @@ -214,6 +215,12 @@ static int iterate_object_props(struct btrfs_root *root, name_ptr = (unsigned long)(di + 1); data_ptr = name_ptr + name_len; + if (verify_dir_item(fs_info, leaf, + path->slots[0], di)) { + ret = -EIO; + goto out; + } + if (name_len <= XATTR_BTRFS_PREFIX_LEN || memcmp_extent_buffer(leaf, XATTR_BTRFS_PREFIX, name_ptr, |