diff options
| author | Su Yue <suy.fnst@cn.fujitsu.com> | 2017-06-06 17:57:05 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2017-06-21 19:16:04 +0200 |
| commit | 59b0a7f2c7c1bf374db319fcc2c99305133d00d5 (patch) | |
| tree | 787cda8c020a0ec7455e45fd015fc21fac3ed89c | |
| parent | 3c1d41844896f59ac771daf146a5329525dc87c5 (diff) | |
btrfs: Check name_len before read in iterate_dir_item
Since iterate_dir_item checks name_len in its own way,
so use btrfs_is_name_len_valid not 'verify_dir_item' to make more strict
name_len check.
Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ switched ENAMETOOLONG to EIO ]
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | fs/btrfs/send.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index a562dc228794..e937c10b8287 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -1069,6 +1069,12 @@ static int iterate_dir_item(struct btrfs_root *root, struct btrfs_path *path, } } + ret = btrfs_is_name_len_valid(eb, path->slots[0], + (unsigned long)(di + 1), name_len + data_len); + if (!ret) { + ret = -EIO; + goto out; + } if (name_len + data_len > buf_len) { buf_len = name_len + data_len; if (is_vmalloc_addr(buf)) { |