Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64c7b014 authored by Su Yue's avatar Su Yue Committed by David Sterba
Browse files

btrfs: Check name_len before in btrfs_del_root_ref



btrfs_del_root_ref calls btrfs_search_slot and reads name from root_ref.
Call btrfs_is_name_len_valid before memcmp.

Signed-off-by: default avatarSu Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 488d7c45
Loading
Loading
Loading
Loading
+7 −0
Original line number Diff line number Diff line
@@ -390,6 +390,13 @@ int btrfs_del_root_ref(struct btrfs_trans_handle *trans,
		WARN_ON(btrfs_root_ref_dirid(leaf, ref) != dirid);
		WARN_ON(btrfs_root_ref_name_len(leaf, ref) != name_len);
		ptr = (unsigned long)(ref + 1);
		ret = btrfs_is_name_len_valid(leaf, path->slots[0], ptr,
					      name_len);
		if (!ret) {
			err = -EIO;
			goto out;
		}

		WARN_ON(memcmp_extent_buffer(leaf, name, ptr, name_len));
		*sequence = btrfs_root_ref_sequence(leaf, ref);