mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
btrfs: Check name_len before in btrfs_del_root_ref
btrfs_del_root_ref calls btrfs_search_slot and reads name from root_ref. Call btrfs_is_name_len_valid before memcmp. Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
parent
488d7c4566
commit
64c7b01446
1 changed files with 7 additions and 0 deletions
|
@ -390,6 +390,13 @@ int btrfs_del_root_ref(struct btrfs_trans_handle *trans,
|
||||||
WARN_ON(btrfs_root_ref_dirid(leaf, ref) != dirid);
|
WARN_ON(btrfs_root_ref_dirid(leaf, ref) != dirid);
|
||||||
WARN_ON(btrfs_root_ref_name_len(leaf, ref) != name_len);
|
WARN_ON(btrfs_root_ref_name_len(leaf, ref) != name_len);
|
||||||
ptr = (unsigned long)(ref + 1);
|
ptr = (unsigned long)(ref + 1);
|
||||||
|
ret = btrfs_is_name_len_valid(leaf, path->slots[0], ptr,
|
||||||
|
name_len);
|
||||||
|
if (!ret) {
|
||||||
|
err = -EIO;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
WARN_ON(memcmp_extent_buffer(leaf, name, ptr, name_len));
|
WARN_ON(memcmp_extent_buffer(leaf, name, ptr, name_len));
|
||||||
*sequence = btrfs_root_ref_sequence(leaf, ref);
|
*sequence = btrfs_root_ref_sequence(leaf, ref);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue