summaryrefslogtreecommitdiff
path: root/fs/btrfs
diff options
context:
space:
mode:
authorSu Yue <suy.fnst@cn.fujitsu.com>2017-06-06 12:57:06 +0300
committerDavid Sterba <dsterba@suse.com>2017-06-21 20:16:04 +0300
commit488d7c4566536b8807381bc54e559fd43decd26a (patch)
tree0eff37754ed219cd199abb743083499983749336 /fs/btrfs
parent59b0a7f2c7c1bf374db319fcc2c99305133d00d5 (diff)
downloadlinux-488d7c4566536b8807381bc54e559fd43decd26a.tar.xz
btrfs: Check name_len before reading btrfs_get_name
In btrfs_get_name, there's btrfs_search_slot and reads name from inode_ref/root_ref. Call btrfs_is_name_len_valid in btrfs_get_name. Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs')
-rw-r--r--fs/btrfs/export.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 87144c9f9593..fa66980726c9 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -282,6 +282,11 @@ static int btrfs_get_name(struct dentry *parent, char *name,
name_len = btrfs_inode_ref_name_len(leaf, iref);
}
+ ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len);
+ if (!ret) {
+ btrfs_free_path(path);
+ return -EIO;
+ }
read_extent_buffer(leaf, name, name_ptr, name_len);
btrfs_free_path(path);