All of lore.kernel.org
 help / color / mirror / Atom feed
From: Su Yue <suy.fnst@cn.fujitsu.com>
To: <linux-btrfs@vger.kernel.org>
Cc: <dsterba@suse.cz>
Subject: [PATCH v3 7/9] btrfs: Check name_len before read in btrfs_get_name
Date: Tue, 6 Jun 2017 17:57:06 +0800	[thread overview]
Message-ID: <20170606095708.494-8-suy.fnst@cn.fujitsu.com> (raw)
In-Reply-To: <20170606095708.494-1-suy.fnst@cn.fujitsu.com>

In 'btrfs_get_name', it does 'btrfs_search_slot' and reads name from
inode_ref/root_ref.

Call btrfs_is_name_len_valid in btrfs_get_name.

Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
---
 fs/btrfs/export.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 87144c9f9593..fa66980726c9 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -282,6 +282,11 @@ static int btrfs_get_name(struct dentry *parent, char *name,
 		name_len = btrfs_inode_ref_name_len(leaf, iref);
 	}
 
+	ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len);
+	if (!ret) {
+		btrfs_free_path(path);
+		return -EIO;
+	}
 	read_extent_buffer(leaf, name, name_ptr, name_len);
 	btrfs_free_path(path);
 
-- 
2.13.0




  parent reply	other threads:[~2017-06-06  9:55 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-06-06  9:56 [PATCH v3 0/9] btrfs: check name_len before read name Su Yue
2017-06-06  9:57 ` [PATCH v3 1/9] btrfs: Introduce btrfs_is_name_len_valid to avoid reading beyond boundary Su Yue
2017-06-06 12:57   ` David Sterba
2017-06-06  9:57 ` [PATCH v3 2/9] btrfs: Check name_len with boundary in verify dir_item Su Yue
2017-06-06  9:57 ` [PATCH v3 3/9] btrfs: Check name_len on add_inode_ref call path Su Yue
2017-06-06  9:57 ` [PATCH v3 4/9] btrfs: Verify dir_item in replay_xattr_deletes Su Yue
2017-06-06  9:57 ` [PATCH v3 5/9] btrfs: Check name_len in btrfs_check_ref_name_override Su Yue
2017-06-06  9:57 ` [PATCH v3 6/9] btrfs: Check name_len before read in iterate_dir_item Su Yue
2017-06-06 13:12   ` David Sterba
2017-06-06  9:57 ` Su Yue [this message]
2017-06-06  9:57 ` [PATCH v3 8/9] btrfs: Check name_len before in btrfs_del_root_ref Su Yue
2017-06-06  9:57 ` [PATCH v3 9/9] btrfs: Verify dir_item in iterate_object_props Su Yue
2017-06-06 13:23 ` [PATCH v3 0/9] btrfs: check name_len before read name David Sterba
2017-06-15 15:57 ` David Sterba
2017-06-16  6:32   ` Su Yue

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170606095708.494-8-suy.fnst@cn.fujitsu.com \
    --to=suy.fnst@cn.fujitsu.com \
    --cc=dsterba@suse.cz \
    --cc=linux-btrfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.