diff options
| author | Su Yue <suy.fnst@cn.fujitsu.com> | 2017-06-06 17:57:04 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2017-06-21 19:16:04 +0200 |
| commit | 3c1d41844896f59ac771daf146a5329525dc87c5 (patch) | |
| tree | 21c1d3f1fa3f6c877c0ffe28231c89aa72ddc9d1 | |
| parent | 8ee8c2d62d5f9e7d1e592426d3d0b941df29f688 (diff) | |
btrfs: Check name_len in btrfs_check_ref_name_override
In btrfs_log_inode, btrfs_search_forward gets the buffer and then
btrfs_check_ref_name_override will read name from ref/extref for the
first time.
Call btrfs_is_name_len_valid before reading name.
Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | fs/btrfs/tree-log.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index 06c7ceb07282..f20ef211a73d 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4562,6 +4562,12 @@ static int btrfs_check_ref_name_override(struct extent_buffer *eb, this_len = sizeof(*extref) + this_name_len; } + ret = btrfs_is_name_len_valid(eb, slot, name_ptr, + this_name_len); + if (!ret) { + ret = -EIO; + goto out; + } if (this_name_len > name_len) { char *new_name; |