Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64c7b014 authored by Su Yue's avatar Su Yue Committed by David Sterba
Browse files

btrfs: Check name_len before in btrfs_del_root_ref 



btrfs_del_root_ref calls btrfs_search_slot and reads name from root_ref.
Call btrfs_is_name_len_valid before memcmp.

Signed-off-by: default avatarSu Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 488d7c45

fs/btrfs/root-tree.c

+7 −0
Original line number Diff line number Diff line
@@ -390,6 +390,13 @@ int btrfs_del_root_ref(struct btrfs_trans_handle *trans, 
		WARN_ON(btrfs_root_ref_dirid(leaf, ref) != dirid);

		WARN_ON(btrfs_root_ref_name_len(leaf, ref) != name_len);

		ptr = (unsigned long)(ref + 1);

		ret = btrfs_is_name_len_valid(leaf, path->slots[0], ptr,

					      name_len);

		if (!ret) {

			err = -EIO;

			goto out;

		}



		WARN_ON(memcmp_extent_buffer(leaf, name, ptr, name_len));

		*sequence = btrfs_root_ref_sequence(leaf, ref);